A response team restores a compromised system from backup before removing the attacker's access. What is the main risk?

1. The incident automatically becomes a false positive
2. The legal reporting period automatically restarts
3. The backup necessarily becomes unencrypted
4. The restored service may be compromised again through the same access path