An analyst suspects a short-lived cloud instance is compromised. Its disk and memory may disappear when it is terminated. What should the response plan enable?

1. Copy only the monthly billing report
2. Contain the instance and preserve relevant volatile and persistent evidence
3. Immediately delete the instance and all associated logs
4. Let the suspected process continue indefinitely without containment