Responders need a playbook for a compromised workload. It must pause for an analyst's approval before revoking the instance role's active sessions and isolating the host, and it must record each step for audit. Which combination best models this?
Show answer and explanation
Answer: D
A multi-step response with branching, retries, and a human decision fits a Step Functions state machine. The workflow can wait for an analyst's decision through a task token callback, then call Systems Manager Automation runbooks to isolate the host and revoke sessions, while execution history provides an audit trail. EventBridge starts the workflow from the finding. A single Lambda function is poorly suited to waiting for a human, Config rules evaluate configuration rather than respond to threats, and suppression rules hide findings instead of acting on them.
Why the other options are wrong
- A. A single Lambda function has a maximum runtime and no built-in approval pause, so long waits and branching get hard to manage and audit. It is better suited to short, simple actions.
- B. Config remediation reacts to configuration drift against a rule, not to a live threat that needs a human decision. It cannot pause for approval or coordinate multi-step containment.
- C. Suppression rules hide matching findings from the active list. They do not isolate hosts, revoke sessions, or run remediation, so they add no response capability.