A server dedicated to the storage and processing of sensitive information was compromised
with a rootkit and sensitive data was exfiltrated. Which of the following incident response
procedures is best suited to restore the server?

A.
Wipe the storage, reinstall the OS from original media and restore the data from the last
known good backup.

B.
Keep the data partition, restore the OS from the most current backup and run a full
system antivirus scan.

C.
Format the storage and reinstall both the OS and the data from the most current backup.

D.
Erase the storage, reinstall the OS from most current backup and only restore the data
that was not compromised.