Explanation (cloud IR reality):
In multi-vector cloud incidents, the defining challenge is coordination across layered services-identity (IAM), networking (WAF/CDN/LB), compute (VMs/containers/functions), email/collaboration, endpoints, and third-party SaaS integrations. Each vector often lands in a different plane: phishing compromises identities; malware persists on endpoints or workloads; DDoS stresses edge/network layers. Responding effectively requires aligning containment actions across these domains so one mitigation doesn't leave another door open (e.g., stopping DDoS but leaving compromised identities active, or cleaning a workload while malicious OAuth tokens remain valid).
(B) is important but is a subset of coordination-CSP communication is one dependency in the broader multi- service response. (C) is a tactical DDoS problem and matters, but the incident includes phishing + malware, so focusing only on traffic classification is insufficient. (A) matters for regulated firms, but during active response, compliance is usually addressed through predefined procedures; it's not the main operational obstacle in stopping a multi-vector campaign.
So (D) best captures the cloud-specific complexity: distributed ownership, shared responsibility boundaries, and the need for synchronized actions (revoking tokens, isolating workloads, adjusting security groups, WAF rules, email protections, and endpoint containment) to truly break the kill chain.