A logistics firm runs critical billing APIs on EC2. Auditors require that leaked IAM access keys be neutralized within minutes without human approval, with full audit trail and stakeholder notice. Manual rotation missed a prior leak for hours. Which automated remediation workflow neutralizes exposed IAM keys within minutes?

The correct workflow succeeds because GuardDuty natively detects exposed IAM keys, EventBridge routes that finding in seconds without polling, Step Functions reliably orchestrates disable, quarantine, and notification with retry and state history, IAM disable stops billing API abuse immediately, SNS meets stakeholder notice, and CloudTrail logging of every step provides the full audit trail. One incorrect workflow uses correct GuardDuty detection and Lambda disable with audit logging but omits stakeholder notice, so it fails the explicit communication concept even though containment is sound and commonly deployed. Another incorrect workflow preserves detection, containment, notification, and audit yet requires manual security approval before action, which reintroduces human delay and violates the within-minutes without human approval concept that caused the prior hours-long miss. The remaining incorrect workflow correctly uses event-driven orchestration with notice and logging but sources detection from Macie for S3 access, confusing detector purpose because Macie finds sensitive data in S3 while only GuardDuty generates IAM key exposure findings, so leaked billing keys would never trigger. Exam caveat is to map each service to its native finding type rather than assuming any security service can remediate any resource, as exams often swap GuardDuty, Macie, and Inspector. Practical check is to simulate a GuardDuty IAM finding in a sandbox, measure time to disable in CloudTrail, and verify Step Functions history plus SNS delivery meet minutes, audit, and notice goals.