Containment is complete and a server is ready for recovery. What should precede reconnecting it to production?

1. Disable monitoring to avoid repeat alerts
2. Reconnect because the original alert was acknowledged
3. Restore the same compromised configuration unchanged
4. Restore a trusted state, remediate the access path, and validate monitoring and operation