A fintech startup runs production in three AWS accounts with GuardDuty disabled and no forensic process. The CISO requires isolated forensic analysis, pre-provisioned emergency access, and always-on detective tooling before launch. Which preparedness design provisions access and security tooling to meet incident readiness?

A dedicated incident response account combined with delegated administrator tooling creates a clean, pre-authorized environment where forensic copies can be isolated without contaminating production, while break-glass roles with MFA, short TTL, and CloudTrail logging provide just-in-time privileged access that is auditable and revocable. Enabling GuardDuty and CloudTrail at the organization level ensures findings and API history are already centralized before an event, which is the core of preparedness under the shared responsibility model. Deploying only Detective in production misses prevention and lacks isolation for forensics, and storing emergency credentials in S3 creates a persistent secret that can leak and be misused. Enabling Security Hub per account without central aggregation fragments visibility and standing admin access violates least privilege by keeping highly privileged paths always warm. Installing EDR agents helps workload visibility but does not solve account isolation or access provisioning, and a shared IAM user destroys attribution and cannot enforce MFA per responder, failing audit and containment needs. For the exam, remember preparedness favors organization-managed detective services plus isolated forensic accounts over ad-hoc credentials, and in practice verify break-glass roles with a game day and confirm GuardDuty coverage across all Regions.