An EC2 instance may be compromised. The incident plan requires containment while preserving forensic evidence. Which initial response is most appropriate?

1. Isolate the instance using a tested containment mechanism and preserve relevant volatile and disk evidence.
2. Terminate the instance and delete all attached volumes before collecting evidence.
3. Leave all network access unchanged until the next scheduled maintenance window.
4. Publish the instance credentials to let external volunteers investigate.