A server is restored from backup after ransomware. What should precede return to normal production access?

1. Validate the clean state, remediate the entry path, and monitor recovery
2. Disable all alerts to keep the recovery dashboard green
3. Copy suspicious executables back for user convenience
4. Reconnect it immediately before checking patch state