An Organization Receives an Alert That Indicates That an EC2

An organization receives an alert that indicates that an EC2 instance behind an ELB Classic Load Balancer has been compromised. What techniques will limit lateral movement and allow evidence gathering?

A) Remove the instance from the load balancer and terminate it.
B) Remove the instance from the load balancer, and shut down access to the instance by tightening the security group.
C) Reboot the instance and check for any Amazon CloudWatch alarms.
D) Stop the instance and make a snapshot of the root EBS volume.