After eradicating malware from a file server, the team plans to restore from backup. Which action best validates the backup is clean before restoration?

Validating a backup before recovery means proving it does not contain the infection you just eradicated. Restoring the backup to an isolated host and scanning it for malware tests the actual content in a place where reinfection cannot spread, and only a clean result earns a return to production. CISA's ransomware guidance stresses restoring from known-clean backups and taking care not to reinfect clean systems during recovery. Hashing the backup against a baseline proves integrity, meaning the file has not changed since the baseline was taken, but if the malware was present when the backup ran, the hash will match perfectly and the infection comes back. Scanning the production server after restoration reverses the order and exposes the environment before anything is verified. Comparing file sizes and modification dates with infected files is unreliable, because malware can preserve timestamps and small changes rarely alter size noticeably. On the exam, distinguish integrity checks, which prove a copy is unaltered, from cleanliness checks, which prove the content is safe. Operationally, pick a restore point that predates the earliest indicator of compromise, restore it to a segregated network, scan with updated signatures and the incident's own IOCs, and document the result before cutover.