A fintech runs 400 EC2 instances handling payments and must pass an audit showing a repeatable malware response. The CISO requires centralized incident tracking, automated isolation steps every analyst follows, and isolated forensic analysis of disk artifacts. Which approach to response plans and runbooks meets all three needs?

Systems Manager OpsCenter provides operational work items that aggregate related GuardDuty, Security Hub, and CloudWatch findings into a single investigable record, while Systems Manager Automation documents supply the codified runbook that isolates instances, captures EBS snapshots, and revokes sessions consistently across shifts, and SageMaker AI notebooks launched in an isolated forensic account allow analysts to mount copies and run Python analysis without contaminating production. GuardDuty with SNS delivers detection and notification but lacks stateful tracking and enforced automation, so different analysts diverge under pressure. Config with State Manager enforces desired configuration and self-healing, which helps hygiene but does not orchestrate incident lifecycle or forensic deep dives. Centralized CloudTrail with Athena and QuickSight improves visibility and hunting yet leaves response manual and unmeasured, failing audit demands for repeatability. On the exam, distinguish detection services from response orchestration and remember OpsCenter plus Automation equals runbook execution. In practice, verify runbooks in a game day and confirm IAM permissions allow cross-account snapshot sharing to the forensics OU.