Charlotte, a cloud administrator, is responsible for managing the cloud infrastructure of a production environment.

Option B. Isolate the compromised EC2 instance is the best answer because the scenario clearly states that Charlotte’s first priority is to limit the spread of the incident and protect other cloud resources from further impact. CHFI v11 includes AWS Forensics , Cloud Forensics , Cloud Computing Threats and Attacks , Data Acquisition in the Cloud , and the broader forensic investigation process, which begins with containment-minded evidence preservation and sound incident handling.

Before deeper acquisition steps such as taking snapshots or attaching evidence volumes, the compromised EC2 instance should be isolated so it can no longer continue interacting with other systems or expanding the breach. This is especially important in cloud environments where lateral movement or automated compromise can affect multiple resources rapidly.

Taking a snapshot is an important forensic step, but in this fact pattern it comes after preventing further spread. Provisioning a forensic workstation and attaching the volume are also later procedural steps. Because CHFI emphasizes both incident response discipline and cloud evidence acquisition, the most appropriate first action here is containment through isolating the compromised EC2 instance .