A company with a single AWS account uses an Amazon EC2 instance to test application code. The instance was recently found to be compromised and serving malware. Analysis shows the compromise occurred 35 days ago. A security engineer must quickly implement continuous monitoring that automatically emails the company’s security team for high-severity compromised-instance findings. Which combination of steps will meet these requirements? (Choose three.)

To detect compromised instances, Amazon GuardDuty is essential as it continuously monitors for malicious activity and unauthorized behavior. Since the compromise occurred 35 days ago, GuardDuty's ability to analyze past activity (up to 90 days) would have been beneficial, but its primary role here is continuous monitoring going forward. An Amazon SNS topic is required to send email notifications to the security team. Finally, an Amazon EventBridge rule is needed to filter for high-severity GuardDuty findings and then publish these specific findings to the SNS topic, triggering the email alerts. Enabling AWS Security Hub is not strictly necessary for this specific requirement, as GuardDuty directly provides the findings. An Amazon SQS queue is for decoupled messaging between services, not for direct email notifications to users. Creating an EventBridge rule for Security Hub findings would be incorrect because the requirement specifies GuardDuty findings, and publishing to an SQS queue would not directly email the security team.