A company runs workloads on hundreds of Amazon EC2 instances. After a recent incident where malware ran until the instance was manually terminated, the company enabled Amazon GuardDuty to detect malware on EC2. The security engineer must automate the response when GuardDuty flags an instance as infected, to mitigate the incident in accordance with the AWS Well-Architected Framework guidance for incident response. Which solution meets these requirements?

The correct solution involves detaching EBS volumes and terminating the instance. This approach isolates the potentially compromised data (on the EBS volumes) for forensic analysis while immediately stopping the malicious activity by terminating the instance. Tagging the volumes as "Infected" aids in tracking and managing the incident. Incorrect options: Removing network adapters or deleting ENIs might stop network communication but leaves the compromised instance running, allowing malware to persist or spread internally. It also doesn't preserve the disk for forensics. Moving the instance to an isolated VPC and applying a deny-all security group is a good containment step but still leaves the compromised instance running, which is not as effective as termination for immediate mitigation and doesn't explicitly preserve the disk for forensics.