A bank's SOC handles EC2 malware alerts inconsistently, with analysts using manual console steps for isolation and evidence collection. Regulators require documented, repeatable runbooks with assigned tasks, timelines, and forensic notes. Which design delivers consistent response plans and trackable execution?

The correct design succeeds because Systems Manager Automation provides versioned, documented runbooks that perform the same isolation and evidence-capture steps on every EC2 malware alert, while OpsCenter wraps each execution in a work item that assigns ownership, enforces timelines, and preserves forensic notes, directly fixing inconsistent manual console work and meeting the regulator demand for repeatable and trackable response. The EventBridge-driven Lambda approach fails by automation without governance, since it can isolate instances and create snapshots rapidly yet lacks a standardized runbook definition with approvals, assigned tasks, and auditable investigation history. The manually executed Automation approach fails by consistency without accountability, because the steps are standardized but execution remains ad hoc with no centralized work item proving who acted, when timelines were met, or what notes support the audit trail. The Security Hub-aggregated OpsCenter workflow fails by tracking without prescriptive response, as it creates well-managed tasks and timelines but leaves containment and evidence collection to analyst discretion rather than an enforced automated sequence. An exam caveat is to distinguish any automation or any ticketing from regulated incident response, since only a runbook plus managed work item satisfies repeatable plus trackable together. A practical check is to open a test OpsCenter work item and confirm it links the Automation execution ID, shows owners and due times, contains timestamped notes, and references the isolated instance ID and snapshot IDs for end-to-end auditability.