A security engineer must design a process to investigate and respond to potential security incidents on Amazon EC2 instances. All instances use Amazon EBS, and AWS Systems Manager with SSM Agent is installed on every instance. The process must follow AWS security best practices and meet these requirements: preserve both volatile and non-volatile memory, update instance metadata with the incident ticket, keep the instance online but isolated, and capture investigative activity during volatile data collection. Which combination of steps meets these requirements with the least operational overhead? (Choose three.)

The correct options outline a robust incident response process. Collecting metadata, enabling termination protection, and isolating the instance via security group rules (rather than moving it to a new subnet, which can change network configurations and complicate analysis) are crucial initial steps. Detaching from Auto Scaling groups and deregistering from ELBs prevents the instance from being replaced or receiving traffic. Using AWS Systems Manager Run Command is the recommended way to collect volatile data remotely without direct SSH/RDP access, which could alter evidence. Creating an EBS snapshot preserves non-volatile data for forensic analysis. Tagging the instance with incident details ensures traceability. Using State Manager for snapshots is less immediate and suitable for ongoing compliance, not incident response.