An incident response team is deciding whether to perform a 'clean rebuild' versus 'clean in place' remediation for a compromised server. What is the primary advantage of a full rebuild from a known good image?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because rebuilding from a known-good image removes all attacker-installed files, persistence mechanisms, and configurations with certainty, whereas in-place cleaning relies on correctly identifying and removing every piece of malware — which may miss subtle persistence. A is wrong because rebuilds are often slower than targeted cleaning, especially for complex systems with many applications.
Full explanation below image
Full Explanation
B is correct because rebuilding from a known-good image removes all attacker-installed files, persistence mechanisms, and configurations with certainty, whereas in-place cleaning relies on correctly identifying and removing every piece of malware — which may miss subtle persistence. A is wrong because rebuilds are often slower than targeted cleaning, especially for complex systems with many applications. C is wrong because a rebuild destroys forensic evidence; evidence collection must occur before rebuilding. D is wrong because root cause analysis is necessary regardless of remediation approach to prevent recurrence.