You need an automated, organization-wide process to isolate compromised Amazon EC2 instances when they receive a specific tag. Which combination of steps will implement this across all accounts? (Choose two.)

The correct solution involves two main components: a mechanism to deploy the automation across accounts and the automation itself. AWS CloudFormation StackSets is the ideal tool for deploying CloudFormation stacks consistently across multiple accounts and regions within an AWS Organization, ensuring the isolation process is available everywhere. The automation involves creating a Lambda function triggered by an Amazon EventBridge rule. This rule detects when the specific "isolation" tag is applied to an EC2 instance. The Lambda then replaces the instance's existing security groups with a highly restrictive security group that has no inbound or outbound rules, effectively isolating the instance from all network traffic. Creating an EC2 instance role with no IAM policies is also a good practice for minimizing potential attack vectors on a compromised instance. An SCP denying ec2: when a tag is false is not suitable for isolating an instance; it would prevent actions based on the tag, not change network connectivity. An SCP attached to the organization root would be too broad and could disrupt legitimate operations if not carefully crafted. The option involving a network ACL and an EC2 instance role with no IAM policies is overly complex and less direct than simply replacing security groups for network isolation.