Quasar Finance operates a single AWS account in eu-west-1. The security team wants to automatically quarantine any EC2 instance that is the target of a GuardDuty UnauthorizedAccess:EC2/SSHBruteForce finding with severity 5 or higher, but only if the instance has the tag Quarantine=true. They want to use EventBridge for near-real-time automation and avoid quarantining untagged instances. Which combination of steps should they implement? (Choose two.)

The first correct option establishes an EventBridge rule to capture GuardDuty findings. It correctly specifies the source as aws.guardduty, the detail.type for SSH brute force, and uses a numeric filter for detail.severity greater than or equal to 5. detail.service.archived = false ensures only active findings are processed. The second correct option uses a Lambda function as the EventBridge target. This is necessary because EventBridge event patterns cannot directly filter on instance tags within the GuardDuty finding detail. The Lambda function will inspect the instance's tags and, if Quarantine=true, trigger the specified Systems Manager Automation runbook for quarantine. The incorrect option suggesting a Security Hub automation rule is wrong because the requirement specifies using EventBridge for near-real-time automation, and Security Hub automation rules are not the primary mechanism for this specific, immediate response. The option to match instance tags directly in the EventBridge event pattern is incorrect because EventBridge event patterns do not support complex conditional logic or nested tag evaluation within the detail object for GuardDuty findings. The option to create the rule only in us-east-1 is incorrect; GuardDuty findings are regional, and the rule must be in eu-west-1 where the EC2 instances operate.