A GuardDuty finding flags EC2 credential exfiltration and Security Hub shows a critical S3 public exposure in prod. The SOC must confirm true positives, scope, and blast radius before containment during an active alert. Which validation workflow should the responder follow to assess event impact?

The correct workflow is right because active credential exfiltration paired with critical S3 exposure demands joint identity and network validation to establish true positive status, affected resources, and blast radius before containment, and correlating GuardDuty with CloudTrail for API actions and VPC Flow Logs for connection evidence provides that complete picture of who used the credentials, what actions were taken, and where data traveled. Validating only the S3 exposure with server access logs and policy review reflects strong posture practice but fails on comprehensive scoping as it confirms just the storage finding while leaving EC2 role abuse unverified, allowing continued misuse of temporary credentials. Reviewing CloudTrail alone for role activity reflects proper privilege analysis but fails on blast radius assessment because API events do not show network destinations, session persistence, or transfer volume needed to prove exfiltration. Reviewing VPC Flow Logs alone for outbound connections reflects proper network triage but fails on attribution because flow records lack IAM identity and S3 data context, so impact cannot be tied to a principal or confirmed as malicious. Exam caveat is that when the stem stresses confirm, scope, and impact before containment, validation answers outrank immediate isolation even under critical severity. Practical check is to align timestamps, instance ID, assumed role ARN, bucket name, and external IP across all three telemetry sources into a single timeline before approving containment.