A penetration tester was able to compromise a server and escalate privileges. Which of the following should the tester perform AFTER concluding the activities on the specified target? (Choose two.)

Removing logs is a malicious act that would hide evidence of the penetration test from the client, hindering their ability to identify and remediate vulnerabilities.

Restoring a server backup is a recovery action typically performed by the client's IT operations, not a post-test cleanup activity by the penetration tester.

Disabling running services would disrupt normal server operations, which is not part of a standard post-exploitation cleanup and could cause service outages.

Removing any tools or scripts installed ensures that no lingering malicious software or backdoors remain on the system after the test, maintaining the system's integrity.

Deleting any created credentials, such as user accounts or API keys, eliminates potential persistence mechanisms and unauthorized access points that could be exploited post-assessment.

Rebooting the target server would disrupt service availability and is not a necessary or appropriate post-exploitation cleanup step for artifact removal.