Amazon GuardDuty has reported that an EC2 instance has been compromised. What of the following actions should you first take to remediate it?

Answer options:

A.Terminate the instance.
B.Delete the IAM Role associated with the EC2 instance.
C.Delete the IAM Key Pair associated with the EC2 instance.
D.Investigate the potentially compromised instance for malware and remove any discovered malware.

Answer: D
Option A is incorrect because terminating the instance will remove user data. You need to investigate the instance to identify the issue firstly.
Option B is incorrect because deleting the IAM role would impact other healthy EC2 instances using the same IAM Role.
Option C is incorrect because deleting the key pair would impact the user utilizing that key pair.
Option D is CORRECT. AWS recommends this method. You can use products from AWS Marketplace that help to identify and remove malware.
Reference:
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_remediate.html#compromised-ec2