AWS Certified Security - Specialty (#123)

A security alert has been raised for an Amazon EC2 instance in a customer account that is exhibiting strange behavior. The Security Engineer must first isolate the EC2 instance and then use tools for further investigation. What should the Security Engineer use to isolate and research this event? (Choose three.)

AWS CloudTrail
Amazon Athena
AWS Key Management Service (AWS KMS)
VPC Flow Logs
AWS Firewall Manager
Security groups