At 02:00 UTC GuardDuty flags an EC2 web server mining crypto, with outbound connections to an unknown IP and IAM role credentials used from that IP. The runbook requires stopping spread, preserving forensics, and restoring service. Which containment and recovery sequence should the responder execute first to isolate the threat?

Revoking the IAM session credentials first stops the stolen role session from being reused from the unknown IP. Attaching the quarantine security group then limits new cryptominer command-and-control and lateral connections without powering off the instance; because security groups do not cut already-tracked connections, pair the change with a restrictive network ACL. Capturing an EBS snapshot preserves disk state for the forensic timeline, and restoring service from a known-good AMI avoids carrying malware persistence into recovery. The sequence that attaches the quarantine group and snapshots before restoring, but does not revoke the session, leaves the stolen credentials usable externally to create resources even after the host is contained. The sequence that revokes credentials and isolates the instance before rebuilding the fleet omits evidence capture, losing malware binaries and attacker activity needed for root cause. The sequence that revokes credentials, isolates, and snapshots but cleans and returns the same host to service risks retaining rootkits or scheduled tasks that survive antivirus and patching. Exam caveat: when GuardDuty reports IAM credential use from outside EC2, credential revocation and network isolation are essential alongside evidence preservation and trusted recovery. Practical check: confirm revocation in IAM Access Advisor and CloudTrail, verify quarantine denies egress, check snapshot completion, then deploy the versioned AMI and rotate exposed keys.