Inform the system owner and the relevant stakeholders about the unauthorized modification is the first action you should take when an unauthorized change is discovered on an information system.

Notifying the owner and stakeholders first allows the organization to coordinate the response and to decide on containment and evidence preservation steps without creating confusion. This communication triggers the incident response process and ensures that legal, business, and IT teams are aware so they can authorize any forensic activities and avoid inadvertent changes that could damage the investigation.

Create a forensic image of the affected system is a valuable investigative step but it is not the immediate first action in this scenario. You should inform the owner and stakeholders so that imaging is done under agreed procedures and with proper chain of custody handling.

Check Cloud Audit Logs for recent administrative and data access events is a useful investigative task but it is not the first action. Accessing logs and performing queries should be coordinated with the system owner and the incident response team to ensure evidence is preserved and that access does not interfere with other response actions.

Perform a security impact assessment to evaluate the change's effects on system security is an important follow up activity but it comes after initial notification and containment. The owner and stakeholders need to be informed so they can prioritize the assessment and allocate the right resources to determine impact and remediation.

Full AWS Practitioner Certification Question