A Linux-based Amazon EC2 instance that uses Amazon EBS storage in a development account is making outbound connections to known malicious IP addresses. The VPC (us-east-1) has an internet gateway and two subnets (us-east-1a and us-east-1b), each with a route table that uses the internet gateway as the default route and the default network ACL. The suspicious instance is the only instance in the us-east-1b subnet. Which response will immediately contain the incident and facilitate root-cause investigation?

The correct option immediately contains the incident by blocking all outbound traffic at the subnet level with a network ACL, which is stateless and processes rules in order. This prevents further malicious communication. Replacing the security group isolates the instance for investigation. The subsequent steps facilitate root-cause analysis by allowing controlled access from a diagnostic instance. The first incorrect option is less immediate and effective because security groups are stateful and process all rules, making a deny rule less precise for immediate containment. Installing tools on a compromised instance risks further compromise. The third incorrect option terminates the instance, which stops the malicious activity but destroys the volatile memory and running process state, hindering a complete root-cause investigation. The fourth incorrect option is incorrect because AWS WAF operates at the application layer (Layer 7) and is primarily for web applications, not for direct control over EC2 instance network traffic at the network layer (Layer 3/4).