Which of the following eradication methods is MOST appropriate when responding to an incident resulting in malware on an application server?

Disconnecting the system from the network is a containment action, not an eradication method; it stops the malware's spread but does not remove it from the system.

Changing passwords on a compromised system is part of post-eradication steps (recovery), and it might not be effective if the system is still infected or if the malware has captured new credentials.

Restoring the system from a known good backup is the most appropriate eradication method for malware on an application server because it reliably removes all traces of the malicious software and returns the system to a pre-infection, trusted state. This approach ensures thorough eradication, minimizes the risk of residual malware, and often simplifies the recovery process compared to attempting to manually clean a potentially deeply compromised system.

Performing operating system hardening is a preventative measure to reduce attack surfaces, not an eradication method for an already infected system.