A company enabled Amazon GuardDuty and wants to automate response to potential threats, starting with RDP brute-force attacks originating from Amazon EC2 instances in its environment. The goal is to block traffic from a suspicious instance until investigation and remediation are complete. Which solution meets these requirements?

The correct solution leverages AWS Security Hub to centralize GuardDuty findings, which then routes them to Amazon EventBridge. EventBridge can trigger an AWS Lambda function. This Lambda function can then interact with AWS Network Firewall to dynamically add a rule that blocks traffic to and from the suspicious EC2 instance, effectively isolating it. This provides a robust, automated response. Incorrect options: Kinesis Data Streams and Kinesis Data Analytics are generally used for real-time data processing and analytics, not for direct security orchestration like blocking traffic with network ACLs, which would be less granular and harder to manage for specific instances. AWS WAF is for protecting web applications and APIs, not for blocking RDP traffic to EC2 instances directly. Replacing a security group with one that denies all connections is a valid isolation strategy, but the question specifically asks for a solution that "blocks traffic from a suspicious instance until investigation and remediation are complete," implying a more dynamic and potentially temporary block, which Network Firewall provides.