A reports an inadequate or failed acceptance condition: The failover record exists, but old cached primary answers persist past the allowed recovery window. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that healthy resolver lookups return the secondary record after the primary endpoint fails. The underlying design requirement is failover routing changes DNS answers; it does not create a healthy standby application automatically.

C reports an inadequate or failed acceptance condition: Two weighted DNS records remain active even when the primary endpoint fails. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that healthy resolver lookups return the secondary record after the primary endpoint fails. The underlying design requirement is failover routing changes DNS answers; it does not create a healthy standby application automatically.

D reports an inadequate or failed acceptance condition: Route 53 returns the secondary DNS name, but its application cannot handle a request. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that healthy resolver lookups return the secondary record after the primary endpoint fails. The underlying design requirement is failover routing changes DNS answers; it does not create a healthy standby application automatically.

A would use an ordinary local Aurora read replica as a substitute for cross-Region database replication. This is not a defensible answer to the stated constraint (An Aurora workload requires low recovery point loss across Regions and regional read capacity): global Database supports dedicated cross-Region replication rather than periodic full snapshot copies. The required design is consider Aurora Global Database with a tested planned or unplanned regional failover procedure; acceptance depends on evidence that secondary Region replication lag and a drill meet the database recovery requirements.

B would treat cross-Region replicated readers as always writable without a documented promotion process. This is not a defensible answer to the stated constraint (An Aurora workload requires low recovery point loss across Regions and regional read capacity): global Database supports dedicated cross-Region replication rather than periodic full snapshot copies. The required design is consider Aurora Global Database with a tested planned or unplanned regional failover procedure; acceptance depends on evidence that secondary Region replication lag and a drill meet the database recovery requirements.

D would keep regional snapshots only and assume they meet low-RPO replication during a Region disaster. This is not a defensible answer to the stated constraint (An Aurora workload requires low recovery point loss across Regions and regional read capacity): global Database supports dedicated cross-Region replication rather than periodic full snapshot copies. The required design is consider Aurora Global Database with a tested planned or unplanned regional failover procedure; acceptance depends on evidence that secondary Region replication lag and a drill meet the database recovery requirements.

A reports an inadequate or failed acceptance condition: The Aurora replica in the primary Region continues reads but cannot survive regional loss. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that secondary Region replication lag and a drill meet the database recovery requirements. The underlying design requirement is global Database supports dedicated cross-Region replication rather than periodic full snapshot copies.

B reports an inadequate or failed acceptance condition: The secondary Aurora instance is readable, but writers have no supported promotion or cutover path. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that secondary Region replication lag and a drill meet the database recovery requirements. The underlying design requirement is global Database supports dedicated cross-Region replication rather than periodic full snapshot copies.

C reports an inadequate or failed acceptance condition: An old cross-Region snapshot restores outside the application's recovery-point window. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that secondary Region replication lag and a drill meet the database recovery requirements. The underlying design requirement is global Database supports dedicated cross-Region replication rather than periodic full snapshot copies.

B would send each payment through SQS but disable idempotency and allow duplicate processing. This is not a defensible answer to the stated constraint (A transaction processor must retain durable messages while a database service is unavailable for 30 minutes): durable buffering isolates transient backend failures if consumers are idempotent. The required design is place idempotently consumed work in an SQS queue with retry controls and a dead-letter queue; acceptance depends on evidence that queue depth rises during the outage, then drains after recovery with no lost or double-applied payment.

C would set the queue retention shorter than the known 30-minute database outage window. This is not a defensible answer to the stated constraint (A transaction processor must retain durable messages while a database service is unavailable for 30 minutes): durable buffering isolates transient backend failures if consumers are idempotent. The required design is place idempotently consumed work in an SQS queue with retry controls and a dead-letter queue; acceptance depends on evidence that queue depth rises during the outage, then drains after recovery with no lost or double-applied payment.

D would synchronously retry every failed database write in API memory until the outage ends. This is not a defensible answer to the stated constraint (A transaction processor must retain durable messages while a database service is unavailable for 30 minutes): durable buffering isolates transient backend failures if consumers are idempotent. The required design is place idempotently consumed work in an SQS queue with retry controls and a dead-letter queue; acceptance depends on evidence that queue depth rises during the outage, then drains after recovery with no lost or double-applied payment.

A reports an inadequate or failed acceptance condition: The payment retry creates duplicate ledger entries after the database recovers. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that queue depth rises during the outage, then drains after recovery with no lost or double-applied payment. The underlying design requirement is durable buffering isolates transient backend failures if consumers are idempotent.

C reports an inadequate or failed acceptance condition: The queued payment expires before the 30-minute provider outage ends. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that queue depth rises during the outage, then drains after recovery with no lost or double-applied payment. The underlying design requirement is durable buffering isolates transient backend failures if consumers are idempotent.

D reports an inadequate or failed acceptance condition: The in-memory request queue empties when the backend database goes offline. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that queue depth rises during the outage, then drains after recovery with no lost or double-applied payment. The underlying design requirement is durable buffering isolates transient backend failures if consumers are idempotent.

A would use a KMS key policy that forbids recovery-account decrypt operations and expect data to mount. This is not a defensible answer to the stated constraint (A service has regional database backups but the team has never restored dependent KMS keys and secrets): a recoverable data file alone does not prove application-level business continuity. The required design is run full regional recovery drills that include key policies, secrets, DNS, networks, and application startup; acceptance depends on evidence that the isolated standby environment reads restored data with authorized keys and handles real test requests.

B would declare regional recovery complete when encrypted backups exist, without testing key and secret access. This is not a defensible answer to the stated constraint (A service has regional database backups but the team has never restored dependent KMS keys and secrets): a recoverable data file alone does not prove application-level business continuity. The required design is run full regional recovery drills that include key policies, secrets, DNS, networks, and application startup; acceptance depends on evidence that the isolated standby environment reads restored data with authorized keys and handles real test requests.

D would restore database volumes but omit the application VPC, DNS, and network dependencies. This is not a defensible answer to the stated constraint (A service has regional database backups but the team has never restored dependent KMS keys and secrets): a recoverable data file alone does not prove application-level business continuity. The required design is run full regional recovery drills that include key policies, secrets, DNS, networks, and application startup; acceptance depends on evidence that the isolated standby environment reads restored data with authorized keys and handles real test requests.

A reports an inadequate or failed acceptance condition: The DR checklist is complete while an end-to-end read request fails in the isolated secondary Region. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that the isolated standby environment reads restored data with authorized keys and handles real test requests. The underlying design requirement is a recoverable data file alone does not prove application-level business continuity.

B reports an inadequate or failed acceptance condition: Encrypted backups can be listed but the standby application receives KMS AccessDenied on restore. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that the isolated standby environment reads restored data with authorized keys and handles real test requests. The underlying design requirement is a recoverable data file alone does not prove application-level business continuity.

C reports an inadequate or failed acceptance condition: The restored database has valid data but private DNS and secrets are unavailable. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that the isolated standby environment reads restored data with authorized keys and handles real test requests. The underlying design requirement is a recoverable data file alone does not prove application-level business continuity.

B would use same-Region S3 replication only, leaving both copies vulnerable to a regional outage. This is not a defensible answer to the stated constraint (A new global static media site needs surviving-region origin content without maintaining duplicate upload jobs): cross-Region Replication copies new eligible objects asynchronously; S3 durability within one Region is not regional DR. The required design is enable supported S3 Cross-Region Replication rules, versioning, and target-bucket access controls; acceptance depends on evidence that a newly uploaded object appears in the target Region with correct encryption and permissions.

C would copy current media objects manually once and stop syncing future uploads. This is not a defensible answer to the stated constraint (A new global static media site needs surviving-region origin content without maintaining duplicate upload jobs): cross-Region Replication copies new eligible objects asynchronously; S3 durability within one Region is not regional DR. The required design is enable supported S3 Cross-Region Replication rules, versioning, and target-bucket access controls; acceptance depends on evidence that a newly uploaded object appears in the target Region with correct encryption and permissions.

D would enable CRR with no destination KMS/bucket permissions for encrypted media versions. This is not a defensible answer to the stated constraint (A new global static media site needs surviving-region origin content without maintaining duplicate upload jobs): cross-Region Replication copies new eligible objects asynchronously; S3 durability within one Region is not regional DR. The required design is enable supported S3 Cross-Region Replication rules, versioning, and target-bucket access controls; acceptance depends on evidence that a newly uploaded object appears in the target Region with correct encryption and permissions.

A reports an inadequate or failed acceptance condition: Objects replicate only within the failed source Region. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a newly uploaded object appears in the target Region with correct encryption and permissions. The underlying design requirement is cross-Region Replication copies new eligible objects asynchronously; S3 durability within one Region is not regional DR.

C reports an inadequate or failed acceptance condition: Destination bucket contains the original upload, but no later new media objects appear. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a newly uploaded object appears in the target Region with correct encryption and permissions. The underlying design requirement is cross-Region Replication copies new eligible objects asynchronously; S3 durability within one Region is not regional DR.

D reports an inadequate or failed acceptance condition: CRR reports failed permissions for encrypted objects written after the initial configuration. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a newly uploaded object appears in the target Region with correct encryption and permissions. The underlying design requirement is cross-Region Replication copies new eligible objects asynchronously; S3 durability within one Region is not regional DR.

A would keep all worker checkpoints only on instances that are lost with the source Region. This is not a defensible answer to the stated constraint (A low-priority batch platform has an RTO of one day and an RPO of a few hours): restore-based DR matches relaxed objectives at lower steady-state cost than active-active capacity. The required design is use cross-Region durable backups and IaC restoration instead of constantly operating a hot fleet; acceptance depends on evidence that a recovery exercise redeploys the workers and restores acceptable checkpoint data inside the agreed period.

B would create an untested infrastructure template but do not back up data or verify recovery deadlines. This is not a defensible answer to the stated constraint (A low-priority batch platform has an RTO of one day and an RPO of a few hours): restore-based DR matches relaxed objectives at lower steady-state cost than active-active capacity. The required design is use cross-Region durable backups and IaC restoration instead of constantly operating a hot fleet; acceptance depends on evidence that a recovery exercise redeploys the workers and restores acceptable checkpoint data inside the agreed period.

D would maintain active-active full production capacity continuously for a low-priority daily-recovery workload. This is not a defensible answer to the stated constraint (A low-priority batch platform has an RTO of one day and an RPO of a few hours): restore-based DR matches relaxed objectives at lower steady-state cost than active-active capacity. The required design is use cross-Region durable backups and IaC restoration instead of constantly operating a hot fleet; acceptance depends on evidence that a recovery exercise redeploys the workers and restores acceptable checkpoint data inside the agreed period.

A reports an inadequate or failed acceptance condition: The standby environment deploys but checkpoint data from the source Region is absent. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a recovery exercise redeploys the workers and restores acceptable checkpoint data inside the agreed period. The underlying design requirement is restore-based DR matches relaxed objectives at lower steady-state cost than active-active capacity.

B reports an inadequate or failed acceptance condition: A restore blueprint exists, but the test workload cannot finish within its one-day RTO. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a recovery exercise redeploys the workers and restores acceptable checkpoint data inside the agreed period. The underlying design requirement is restore-based DR matches relaxed objectives at lower steady-state cost than active-active capacity.

C reports an inadequate or failed acceptance condition: Full active-active resources run continuously and generate costs beyond the low-priority design budget. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a recovery exercise redeploys the workers and restores acceptable checkpoint data inside the agreed period. The underlying design requirement is restore-based DR matches relaxed objectives at lower steady-state cost than active-active capacity.