A retail company needs faster EC2 malware response with consistent isolation steps, assigned owners, and timeline tracking across shifts. Analysts currently use chat messages and manual console clicks with no audit trail. Which runbook design should the incident lead adopt to standardize response tracking with automated isolation?

The correct design succeeds because OpsCenter provides centralized work items with clear ownership, status, and deduplicated timelines that persist across shifts for auditability, while the native link to Automation runbooks enforces consistent, repeatable EC2 isolation actions such as security-group quarantine without relying on chat messages or manual console clicks. The EventBridge to Automation with CloudTrail logging design is operationally sound for rapid containment and is commonly used for auto-remediation, but it fails the ownership and shift-handoff concept because CloudTrail records API activity rather than providing assignable tasks, progress tracking, and collaborative timeline notes. The OpsCenter design documenting manual console steps correctly addresses accountability and auditability and reflects a common maturity starting point, but it fails the automation concept by retaining human execution latency and click-by-click variability that cannot deliver faster, standardized containment. The OpsCenter plus Automation design capturing EBS snapshots is a best-practice forensic preservation pattern often paired with malware response, but it fails the containment concept because a snapshot aids investigation and recovery and does not sever network access or stop lateral movement like host isolation does. For the exam, beware that any mention of logging or ticketing alone does not equal ownership with timeline tracking, and forensic collection must not be mistaken for isolation; in practice, verify the OpsItem is auto-created from the GuardDuty finding, carries an owner and severity, invokes the isolation Automation with least-privilege execution role, and that timeline entries and Automation outputs are retained for post-incident review.