An Amazon EC2 instance suddenly shows high CPU usage. It is unclear whether the instance is compromised or performing normal OS background tasks. Which actions should a security engineer take before starting the investigation? (Choose three.)

When investigating a potentially compromised EC2 instance, the primary goal is to preserve evidence while preventing further damage. Enabling termination protection prevents accidental or malicious termination of the instance during the investigation, ensuring the evidence remains available. Creating snapshots of EBS volumes creates a point-in-time copy of the disk, allowing for forensic analysis without altering the running instance. Recording instance metadata and tagging it as quarantined helps track the compromised resource, isolates it from normal operations, and provides crucial context for the investigation. Disabling termination protection would risk losing the instance and its evidence. Deleting snapshots would destroy valuable historical data. Removing sensitive entries from metadata could alter evidence and hinder the investigation.