During the recovery phase of an incident, you must restore a group of affected systems. All machines have a recent, verified clean backup available. However, you have been informed that a persistent threat actor had previously established a foothold in the network. What is the BEST step to ensure the re-imaging process prevents the actor from regaining access to the systems?
Only install the latest security patches on the systems prior to re-imaging processes.
Integrate additional monitoring tools during the re-imaging process to increase surveillance.
Re-image systems with the clean backup and modify default credentials and access controls before reconnection.
Perform a bare-metal restore and immediately reconnect systems to the network.