The correct option is A documented procedure that limits the impact and spread of an information security incident.

A containment plan is exactly a documented procedure that limits the impact and spread of an information security incident because it defines roles, decision points, and technical steps to prevent further compromise while allowing investigation and recovery to proceed.

A good documented procedure will include short term containment actions, longer term controls, communication and escalation paths, and guidance for preserving forensic evidence so that eradication and recovery can follow in a controlled way.

Security Command Center is incorrect because it names a product or tool rather than describing a procedural plan for responding to incidents. A product can support containment but it does not itself define the documented steps and policies that a containment plan requires.

A procedure for managing the spread of a natural disaster is incorrect because it refers to physical disaster management and not to limiting the impact and spread of an information security incident. Containment plans focus on cyber incidents and the technical and procedural controls needed to contain them.

A strategy to isolate infected endpoints by disconnecting them from the network is incorrect because it describes one possible containment action but it is too narrow to be the full plan. Disconnecting endpoints may be part of containment, but a complete containment plan is documented, covers multiple scenarios, and balances containment with evidence preservation and business continuity.

Full AWS Practitioner Certification Question