A security engineer needs to develop a process to investigate and respond to potential security events on a company's Amazon EC2 instances. All the EC2 instances are backed by Amazon Elastic Block Sto

Gathering metadata and enabling termination protection prevents accidental or automated termination of the compromised instance, preserving forensic evidence. Applying an isolation security group (with no inbound/outbound rules) cuts off network communication without shutting the instance down, keeping volatile memory intact while meeting the requirement to remain online.

This option describes a different sequence or set of actions that does not fully satisfy the stated requirements for isolation and evidence preservation in the correct order.

AWS Systems Manager Run Command allows scripts to execute on the instance without opening SSH or RDP, which could alter volatile memory. This method safely captures volatile data such as running processes, network connections, and memory contents in accordance with forensic best practices.

Establishing an SSH or RDP session to a compromised instance is a forensic anti-pattern because interactive logins modify volatile memory, update file access times, and can inadvertently destroy evidence or allow lateral movement by an attacker.

Creating an EBS snapshot captures the non-volatile state of all attached volumes at a point in time, preserving the file system, logs, and other disk artifacts needed for forensic analysis. Snapshots can be analyzed in a separate, clean environment without modifying the original evidence.

A Systems Manager State Manager association creates scheduled associations, not immediate one-time actions. Using it for forensic snapshot capture introduces unnecessary delay and is designed for ongoing configuration management, not incident response.