A Critical Server Was Compromised by Malware, and All Functionality

Multiple Choice

A critical server was compromised by malware, and all functionality was lost. Backups of this server were taken; however, management believes a logic bomb may have been injected by a rootkit. Which of the following should a security analyst perform to restore functionality quickly?

A) Work backward, restoring each backup until the server is clean
B) Restore the previous backup and scan with a live boot anti-malware scanner
C) Stand up a new server and restore critical data from backups
D) Offload the critical data to a new server and continue operations