A parks department quarantines a compromised ECS task without taking down the entire cluster serving park reservations. What containment approach is that?

Scoped automated containment that quarantines the compromised municipal container task without collapsing the whole cluster preserves parks reservation availability while isolating the bad ECS task. Surgical containment—stop or replace the affected task, restrict its network path, or move it to a quarantine capacity—limits attacker reach without rolling out a new image to every task in the account. That approach matches civic expectations that one compromised task should not force a full outage of citizen-facing park reservation workloads.

Scoped automated containment that redeploys the compromised municipal container task from the latest approved image version fails because it is recovery, not scoped quarantine: it replaces the task without isolating the live malicious workload, restricting its network path, or stopping its current activity. Scoped automated containment that quarantines the compromised municipal container image without pausing the running task fails because it targets the image, not the live workload: the compromised task keeps running and can continue malicious activity until it is stopped, isolated, or replaced. Scoped automated containment that revokes the compromised municipal task IAM session without isolating the container workload fails as containment because it does not stop or isolate the compromised container itself; the task can keep running with cached credentials or mounted secrets, leaving the malicious workload in the cluster.

Exam caveat: Prefer scoped container containment that quarantines the task over scoped redeploys from the latest approved image version, image-only quarantine without pausing the running task, or IAM session revocation without isolating the workload when the stem emphasizes quarantining one task while keeping the cluster serving reservations.

Operational check for parks DevOps/security: in a non-production ECS cluster, mark one task compromised, run scoped quarantine automation, confirm sibling services continue serving, verify the quarantined task cannot reach sensitive networks, and document that scoped automated containment that revokes the compromised municipal task IAM session without isolating the container workload alone is not task containment because the compromised task may keep running with cached credentials.