An online learning platform runs 80 EC2 instances for virtual labs. Security requires GuardDuty EC2 findings to trigger isolation within minutes, capture disk evidence automatically, open a ticket, and avoid manual logins. Which automated remediation workflow isolates the host and preserves forensic evidence within minutes?

The correct workflow works because EventBridge reacts to GuardDuty findings in seconds and Step Functions orchestrates Systems Manager Automation to isolate the instance, snapshot EBS volumes, and create a ticket via API without manual logins, meeting minutes-level containment, forensics, ticketing, and hands-off requirements in one auditable run. The Lambda workflow with security-group revocation, EBS snapshots, and SNS alerts fails on fulfillment concept because pub-sub notification alerts humans but does not open a tracked ticket with ownership and lifecycle, so ticketing is missing despite good isolation and evidence capture. The scheduled hourly workflow from Security Hub fails on timeliness concept because interval polling cannot guarantee action within minutes, leaving attacker dwell time even though isolation, snapshots, and tickets are implemented. The Step Functions workflow that snapshots volumes and creates Jira tickets via Lambda fails on containment concept because collecting evidence and tracking work without network isolation leaves the suspect host connected and enables lateral movement. Exam caveat is to distinguish event-driven versus scheduled triggers and ticketing versus notification, as questions test those precise verbs. Practical check is to confirm the EventBridge pattern matches GuardDuty severity, the Automation document has least-privilege rights for network changes and snapshots, and a full drill in nonproduction verifies isolation time and ticket creation.