A suspected compromised instance still serves production traffic. Which response is most appropriate?

1. Delete every log before isolating the instance.
2. Ignore the incident because the instance has a private address.
3. Grant the instance more privileges to see whether the problem stops.
4. Follow the incident plan to contain access, preserve evidence, and maintain service through healthy resources.