A SaaS startup must improve readiness for EC2 ransomware containment with isolated forensics, pre-approved responder access, and deployed investigation tooling before any incident occurs. Limited staff need automated isolation and evidence collection. Which incident preparation approach using AWS capabilities best meets these readiness requirements?

The correct approach succeeds because it addresses all stated readiness elements together: a dedicated forensics OU provides account-level isolation for suspect EC2 instances, volumes and logs to prevent lateral movement and preserve chain of custody, pre-created responder roles satisfy pre-approved access so limited staff can act immediately without waiting for approvals, pre-deployed EDR ensures investigation tooling and telemetry are already present before any incident, and automated isolation runbooks deliver consistent containment and evidence collection at speed. The centralized security account alternative fails by concept because governance without a separate forensics boundary risks contamination and operational interference, even though roles, tooling and automation are strong. The incident-time access alternative fails by concept because provisioning permissions after declaration violates the pre-approved requirement and introduces delay exactly when rapid containment is needed for ransomware. The analyst-directed containment alternative fails by concept because reliance on human decisions for each isolation and snapshot step cannot meet the limited-staff automation requirement and increases inconsistency under pressure. On exams, focus on temporal cues like before any incident versus during incidents to distinguish preparation from response, and in practice verify OU controls, cross-account role trust, EDR coverage on all images, and regularly test runbooks with game days to confirm snapshots, tagging and network quarantine work as expected.