An online gaming studio runs matchmaking on EC2 Auto Scaling groups across three AZs. Security requires that suspected compromised hosts be isolated automatically, have EBS snapshots captured for forensics with chain-of-custody tags, and notify moderators for approval before termination. Which automated remediation design should the architect implement to contain EC2 incidents forensically?

The correct design succeeds because it chains all three mandated controls in proper order: immediate network isolation to stop lateral movement, forensic-grade EBS snapshots annotated with chain-of-custody tags to preserve admissibility, and human-gated termination via SNS so moderators authorize destructive action while automation handles containment. The EventBridge plus Systems Manager design that isolates promptly and snapshots before approved termination fails on evidentiary integrity because untagged snapshots cannot prove ownership, timeline, or handling for legal review despite being technically complete. The Step Functions design centered on CloudWatch logs and memory dumps with proper tagging and approval fails on evidence scope because volatile logs complement but do not replace block-level disk images required for full forensic reconstruction of compromise. The GuardDuty-triggered workflow that seeks approval before any isolation fails on containment timing because requiring human sign-off before quarantine leaves the suspect host reachable during attacker dwell time, violating the automatic isolation mandate. Exam caveat: distinguish isolation, which must be immediate and automatic, from termination, which must be manual-approved, as stems often test this ordering. Practical check: validate in a game-dev account that isolation security-group changes apply, snapshots inherit custody tags, and SNS approvals pause termination in Step Functions execution history.