A media firm detected cryptomining on three EC2 instances in a public subnet, with suspicious outbound connections and a potentially exposed key pair. The workload must stay online for forensics, stop lateral movement, remove the miner, and restore clean operation. Which incident response sequence contains and eradicates the threat while enabling recovery?

Quarantine security groups contain the threat by blocking lateral movement and suspicious outbound connections while keeping the instances powered for forensics. Capturing memory and disk evidence before cleanup preserves volatile data; revoking the potentially exposed key pair blocks attacker re-entry, removing the malware eradicates active cryptomining, and restoring from verified clean backups removes persistence and enables recovery. Quarantining, collecting memory, cleaning miners, and patching in place addresses containment, evidence, and malware but does not revoke the exposed key, leaving a route for reinfection. Quarantining, revoking keys, and rebuilding from clean backups provides containment and recovery, but terminating hosts at once destroys volatile memory and live-process evidence needed for forensics. Keeping hosts online for capture, then isolating, revoking keys, removing miners, and rebooting preserves evidence and addresses the visible infection, but trusts a compromised host instead of restoring a known-good system; hidden cron jobs or rootkits may remain. Exam caveat: a recent snapshot or rebooted infected host is not equivalent to a clean backup, and an exposed EC2 key pair requires explicit revocation. As a practical check, verify quarantine rules allow only the forensic collector, confirm the old key no longer authenticates, and scan restored hosts and monitor outbound traffic before returning them to the public subnet.