If an alert that pertains to a remote code execution attempt is seen on your network, which step is unlikely to help?
A. looking for anomalous traffic
B. looking for reconnaissance activity
C. restoring the machine to a known good backup
D. clearing the event store to see if future events indicate malicious activity