A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group and use Amazon Elastic Block Store (Amazon EBS) volumes. A security engineer must preserve all forensic evidence from one instance. In what order should the engineer perform the steps?

To preserve forensic evidence, the instance must first be isolated to prevent further changes or termination by automated services. Detaching the instance from the Auto Scaling group ensures it won't be terminated or replaced, and deregistering it from the ALB stops new traffic. Taking an EBS volume snapshot captures the persistent storage state. A memory snapshot is crucial for volatile data, and it should be taken while the instance is running to capture the live state. Finally, stopping the instance prevents further modification of its state. Other options either stop the instance too early, losing live memory data, or fail to isolate it from the Auto Scaling group or ALB, risking termination or continued traffic.