A fintech exchange faces stolen IAM keys used to launch mining EC2 instances across two accounts. Leadership wants defined responder roles, isolated forensic examination without contaminating evidence, tracked containment tasks, and post-incident analysis of large CloudTrail datasets. Auditors require repeatable runbooks. Which response plan should the incident lead implement to coordinate roles, forensics, and lessons learned?

A complete plan defines RACI roles so containment, forensics, and communications have clear owners, uses Systems Manager OpsCenter operational work items to create, assign, and track response tasks with audit history, invokes Systems Manager Automation runbooks to isolate EC2 instances, snapshot EBS volumes, and revoke keys in a dedicated forensic account without destroying volatile evidence, and uses SageMaker AI notebooks to query and visualize large CloudTrail datasets for timeline and lessons-learned analysis. Email tracking fails by concept because threads lack status, ownership, and auditability required for coordinated response. Immediate deletion fails by concept because destroying instances eliminates memory and disk evidence needed for forensic determination. Billing-only review fails by concept because cost anomalies cannot reconstruct attacker actions or control gaps for improvement. For the exam remember OpsCenter coordinates tasks while Automation executes containment and notebooks enable analysis at scale, and in practice test runbooks with game days, pre-provision forensic accounts, and protect logs with Object Lock.