A SaaS company sees GuardDuty malware findings on production EC2 hosts. Leadership requires automatic isolation within minutes, forensic disk capture for legal hold, and a tracked approval before rejoining fleet. Which automated remediation design satisfies the incident response requirement?
Select an answer to reveal the explanation.
Short Explanation
You've got to move fast on malware without losing evidence for legal hold. That's why orchestration works like an assembly line with safety checks, isolating hosts, grabbing EBS snapshots, and holding rejoin until your approval's tracked.
Full Explanation
The correct design meets all three constraints where GuardDuty findings trigger Step Functions orchestration of Systems Manager Automation to apply security-group isolation within minutes, create encrypted EBS snapshots with legal-hold tags for forensic preservation, and enforce a tracked approval task before any rejoin runs, maintaining chain of custody. The ServiceNow isolate-and-approve design fails by concept because governance without disk capture cannot satisfy legal hold, since logs and live state are volatile and do not preserve block evidence. The snapshot-and-approve design fails by concept because preserving evidence and gating rejoin without immediate containment violates minutes-scale isolation and allows lateral movement while imaging completes. The Lambda isolate-and-snapshot design fails by concept because automatic containment and imaging without tracked human authorization permits unverified rejoin of still-infected hosts and lacks auditable accountability. An exam caveat is that SNS, Slack, or Jira messages count as tracked approval only when implemented as a blocking workflow task with identity, timestamp, and decision record, not as alerts. As a practical check, run a game day to confirm isolation in minutes, snapshots tagged, encrypted and locked, and CloudTrail plus execution history show isolate, snapshot, approve, and rejoin with approver identity.