An EC2 instance shows credible compromise indicators. The incident team needs containment and forensic evidence under its approved response plan. Which actions are appropriate? Select 2 answers.

1. Assume changing an instance display name removes attacker access.
2. Apply the approved isolation controls while preserving the access needed for authorized evidence collection.
3. Capture and protect relevant logs, snapshots, and time-sensitive evidence with documented handling.
4. Terminate every suspected instance immediately before preserving any evidence, regardless of the plan.
5. Share captured credentials in a public incident channel.