When an EC2 instance shows signs of compromise (C2 communication detected by GuardDuty, cryptomining, backdoor detection), two conflicting instincts work simultaneously in responders' minds: "I want to shut it down fast (containment)" and "I don't want to lose evidence (preservation)". The essence of compromised EC2 incident response is reconciling both in the correct order and method. Carelessly terminating destroys volatile evidence like memory and connection states, while leaving it running allows lateral movement and data exfiltration. The exam tests "in what order and by what mechanism do you isolate, preserve, and revoke?"