A web server has been compromised due to a ransomware attack.

The last incremental backup that was conducted 72 hours ago would be the best option to restore the services to a secure state, as it would contain the most recent data before the ransomware infection. Incremental backups only store the changes made since the last backup, so they are faster and use less storage space than full backups. Restoring from an incremental backup would also minimize the data loss and downtime caused by the ransomware attack. References:

https://www.comptia.org/blog/mature-cybersecurity-response-to-ransomware

https://www.youtube.com/watch?v=HszU4nEAlFc