A reports an inadequate or failed acceptance condition: One Fargate task stays running at fixed capacity but fails to expand under load. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a task deployment scales across subnets with no EC2 worker fleet to patch. The underlying design requirement is fargate removes host-capacity operations; ECS on self-managed EC2 requires cluster instance management.

C reports an inadequate or failed acceptance condition: EKS worker hosts are maintained by the team despite its no-worker-operations requirement. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a task deployment scales across subnets with no EC2 worker fleet to patch. The underlying design requirement is fargate removes host-capacity operations; ECS on self-managed EC2 requires cluster instance management.

D reports an inadequate or failed acceptance condition: The service's worker EC2 nodes are patched manually by the application team. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a task deployment scales across subnets with no EC2 worker fleet to patch. The underlying design requirement is fargate removes host-capacity operations; ECS on self-managed EC2 requires cluster instance management.

A would create an RDS read replica only and assume it protects against destructive CloudFormation replacement. This is not a defensible answer to the stated constraint (A stateful service is upgraded by replacing its CloudFormation stack but a critical database must survive rollback): decoupling durable data from frequently replaced compute prevents destructive infrastructure rollbacks. The required design is use a separate durable data stack with appropriate retention and export references for compute stack replacement; acceptance depends on evidence that application-stack rollback leaves the database and its data intact.

B would delete the old database during stack replacement and restore from an untested snapshot. This is not a defensible answer to the stated constraint (A stateful service is upgraded by replacing its CloudFormation stack but a critical database must survive rollback): decoupling durable data from frequently replaced compute prevents destructive infrastructure rollbacks. The required design is use a separate durable data stack with appropriate retention and export references for compute stack replacement; acceptance depends on evidence that application-stack rollback leaves the database and its data intact.

D would put the database and replaceable service into the same stack with default deletion behavior. This is not a defensible answer to the stated constraint (A stateful service is upgraded by replacing its CloudFormation stack but a critical database must survive rollback): decoupling durable data from frequently replaced compute prevents destructive infrastructure rollbacks. The required design is use a separate durable data stack with appropriate retention and export references for compute stack replacement; acceptance depends on evidence that application-stack rollback leaves the database and its data intact.

A reports an inadequate or failed acceptance condition: The read replica retains stale data but no retained writer database survives the stack replacement. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that application-stack rollback leaves the database and its data intact. The underlying design requirement is decoupling durable data from frequently replaced compute prevents destructive infrastructure rollbacks.

B reports an inadequate or failed acceptance condition: The database enters DELETE_COMPLETE when the replacement application stack is removed. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that application-stack rollback leaves the database and its data intact. The underlying design requirement is decoupling durable data from frequently replaced compute prevents destructive infrastructure rollbacks.

C reports an inadequate or failed acceptance condition: A rollback completes for the frontend but the RDS endpoint no longer serves old data. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that application-stack rollback leaves the database and its data intact. The underlying design requirement is decoupling durable data from frequently replaced compute prevents destructive infrastructure rollbacks.

B would execute a CloudFormation update directly without reviewing changes to regulated networking. This is not a defensible answer to the stated constraint (An infrastructure pipeline needs to detect drift before changes to a regulated networking stack): iaC change sets preview intended mutations, while drift detection identifies out-of-band changes. The required design is run CloudFormation drift detection and review change sets prior to execution; acceptance depends on evidence that unmanaged changes are reported and the change set enumerates approved resource modifications.

C would run drift detection against an unrelated stack instead of the intended network resources. This is not a defensible answer to the stated constraint (An infrastructure pipeline needs to detect drift before changes to a regulated networking stack): iaC change sets preview intended mutations, while drift detection identifies out-of-band changes. The required design is run CloudFormation drift detection and review change sets prior to execution; acceptance depends on evidence that unmanaged changes are reported and the change set enumerates approved resource modifications.

D would approve the change solely because template syntax validates, without inspecting actual drift or change sets. This is not a defensible answer to the stated constraint (An infrastructure pipeline needs to detect drift before changes to a regulated networking stack): iaC change sets preview intended mutations, while drift detection identifies out-of-band changes. The required design is run CloudFormation drift detection and review change sets prior to execution; acceptance depends on evidence that unmanaged changes are reported and the change set enumerates approved resource modifications.

A reports an inadequate or failed acceptance condition: CloudFormation template syntax validates while a manual subnet route deviation remains undetected. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that unmanaged changes are reported and the change set enumerates approved resource modifications. The underlying design requirement is iaC change sets preview intended mutations, while drift detection identifies out-of-band changes.

C reports an inadequate or failed acceptance condition: A drift report is generated for the wrong networking stack. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that unmanaged changes are reported and the change set enumerates approved resource modifications. The underlying design requirement is iaC change sets preview intended mutations, while drift detection identifies out-of-band changes.

D reports an inadequate or failed acceptance condition: A change set has no resource details even though regulated routes will be modified. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that unmanaged changes are reported and the change set enumerates approved resource modifications. The underlying design requirement is iaC change sets preview intended mutations, while drift detection identifies out-of-band changes.

A would copy application binaries directly via SSH and omit lifecycle hooks and rollback. This is not a defensible answer to the stated constraint (A service release must deploy on-premises and EC2 instances using the same controlled rollout service): codeDeploy supports server deployments in both EC2 and on-premises settings; CodeBuild only builds artifacts. The required design is use CodeDeploy with deployment groups, lifecycle hooks, and a health-based rollback plan; acceptance depends on evidence that deployment records show target hosts, hook completion, and rollback on failed validation.

B would deploy to EC2 only while treating on-premises server groups as automatically included. This is not a defensible answer to the stated constraint (A service release must deploy on-premises and EC2 instances using the same controlled rollout service): codeDeploy supports server deployments in both EC2 and on-premises settings; CodeBuild only builds artifacts. The required design is use CodeDeploy with deployment groups, lifecycle hooks, and a health-based rollback plan; acceptance depends on evidence that deployment records show target hosts, hook completion, and rollback on failed validation.

D would use CodeDeploy configuration with no registered on-premises instances or deployment groups. This is not a defensible answer to the stated constraint (A service release must deploy on-premises and EC2 instances using the same controlled rollout service): codeDeploy supports server deployments in both EC2 and on-premises settings; CodeBuild only builds artifacts. The required design is use CodeDeploy with deployment groups, lifecycle hooks, and a health-based rollback plan; acceptance depends on evidence that deployment records show target hosts, hook completion, and rollback on failed validation.

A reports an inadequate or failed acceptance condition: An SSH script finishes on two servers but the deployment group and rollback state remain unknown. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that deployment records show target hosts, hook completion, and rollback on failed validation. The underlying design requirement is codeDeploy supports server deployments in both EC2 and on-premises settings; CodeBuild only builds artifacts.

B reports an inadequate or failed acceptance condition: The new release stays deployed after a failed on-premises health hook. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that deployment records show target hosts, hook completion, and rollback on failed validation. The underlying design requirement is codeDeploy supports server deployments in both EC2 and on-premises settings; CodeBuild only builds artifacts.

C reports an inadequate or failed acceptance condition: The deployment record lists only EC2 targets and no on-premises registered hosts. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that deployment records show target hosts, hook completion, and rollback on failed validation. The underlying design requirement is codeDeploy supports server deployments in both EC2 and on-premises settings; CodeBuild only builds artifacts.

B would cut over based only on instance launch completion without validating the replacement application readiness. This is not a defensible answer to the stated constraint (A team cannot pause all user requests while replacing a schema-compatible application version behind an ALB): traffic-shift deployment limits downtime and exposes a reliable rollback target. The required design is run a second target group and cut traffic using blue/green deployment and readiness checks; acceptance depends on evidence that new targets pass health checks before traffic leaves the old target group.

C would terminate the old targets before the new target group passes ALB health checks. This is not a defensible answer to the stated constraint (A team cannot pause all user requests while replacing a schema-compatible application version behind an ALB): traffic-shift deployment limits downtime and exposes a reliable rollback target. The required design is run a second target group and cut traffic using blue/green deployment and readiness checks; acceptance depends on evidence that new targets pass health checks before traffic leaves the old target group.

D would update the existing target group in place and route all user traffic during its restart. This is not a defensible answer to the stated constraint (A team cannot pause all user requests while replacing a schema-compatible application version behind an ALB): traffic-shift deployment limits downtime and exposes a reliable rollback target. The required design is run a second target group and cut traffic using blue/green deployment and readiness checks; acceptance depends on evidence that new targets pass health checks before traffic leaves the old target group.

A reports an inadequate or failed acceptance condition: A deployment log reports success even though clients received errors during the switchover. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that new targets pass health checks before traffic leaves the old target group. The underlying design requirement is traffic-shift deployment limits downtime and exposes a reliable rollback target.

C reports an inadequate or failed acceptance condition: ALB traffic shifts away from old targets while the new target group still reports Unhealthy. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that new targets pass health checks before traffic leaves the old target group. The underlying design requirement is traffic-shift deployment limits downtime and exposes a reliable rollback target.

D reports an inadequate or failed acceptance condition: Instances finish booting but the replacement application's readiness endpoint fails. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that new targets pass health checks before traffic leaves the old target group. The underlying design requirement is traffic-shift deployment limits downtime and exposes a reliable rollback target.

A would embed the database password as a plaintext container environment value committed with the build artifact. This is not a defensible answer to the stated constraint (Developers need secure deployment-time database credentials without storing passwords in build artifacts): retrieving a managed secret at runtime avoids embedding sensitive credentials into images or pipelines. The required design is grant the runtime role permission to retrieve a secret from Secrets Manager and use rotation-aware references; acceptance depends on evidence that deployed task definitions contain no literal password and the application retrieves the current secret.

B would give the deployment pipeline an unrestricted long-lived database password rather than runtime IAM access. This is not a defensible answer to the stated constraint (Developers need secure deployment-time database credentials without storing passwords in build artifacts): retrieving a managed secret at runtime avoids embedding sensitive credentials into images or pipelines. The required design is grant the runtime role permission to retrieve a secret from Secrets Manager and use rotation-aware references; acceptance depends on evidence that deployed task definitions contain no literal password and the application retrieves the current secret.

D would retrieve the current secret once at build time and bake it into immutable image layers. This is not a defensible answer to the stated constraint (Developers need secure deployment-time database credentials without storing passwords in build artifacts): retrieving a managed secret at runtime avoids embedding sensitive credentials into images or pipelines. The required design is grant the runtime role permission to retrieve a secret from Secrets Manager and use rotation-aware references; acceptance depends on evidence that deployed task definitions contain no literal password and the application retrieves the current secret.

A reports an inadequate or failed acceptance condition: The container image includes a literal password in its environment defaults. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that deployed task definitions contain no literal password and the application retrieves the current secret. The underlying design requirement is retrieving a managed secret at runtime avoids embedding sensitive credentials into images or pipelines.

B reports an inadequate or failed acceptance condition: Build logs show a successful secret retrieval, but the deployed app still uses the old baked-in value. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that deployed task definitions contain no literal password and the application retrieves the current secret. The underlying design requirement is retrieving a managed secret at runtime avoids embedding sensitive credentials into images or pipelines.

C reports an inadequate or failed acceptance condition: Secrets Manager rotates the credential and the application loses DB access because it never refreshes. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that deployed task definitions contain no literal password and the application retrieves the current secret. The underlying design requirement is retrieving a managed secret at runtime avoids embedding sensitive credentials into images or pipelines.