A reports an inadequate or failed acceptance condition: The standby environment deploys but checkpoint data from the source Region is absent. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a recovery exercise redeploys the workers and restores acceptable checkpoint data inside the agreed period. The underlying design requirement is restore-based DR matches relaxed objectives at lower steady-state cost than active-active capacity.

B reports an inadequate or failed acceptance condition: A restore blueprint exists, but the test workload cannot finish within its one-day RTO. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a recovery exercise redeploys the workers and restores acceptable checkpoint data inside the agreed period. The underlying design requirement is restore-based DR matches relaxed objectives at lower steady-state cost than active-active capacity.

C reports an inadequate or failed acceptance condition: Full active-active resources run continuously and generate costs beyond the low-priority design budget. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a recovery exercise redeploys the workers and restores acceptable checkpoint data inside the agreed period. The underlying design requirement is restore-based DR matches relaxed objectives at lower steady-state cost than active-active capacity.

B would route surviving-region clients to a failed Region's endpoint rather than a writable replica. This is not a defensible answer to the stated constraint (A DynamoDB service using eventually consistent global tables needs continued regional writes when an AWS Region is isolated): global tables provide multi-Region replicated writes with eventual consistency between Regions; client routing and conflict semantics still matter. The required design is design DynamoDB global tables with suitable conflict resolution and client routing considerations; acceptance depends on evidence that region-failure testing shows the surviving replica accepts writes and data converges as designed.

C would use a single-Region DynamoDB table and expect writes to continue if that Region is isolated. This is not a defensible answer to the stated constraint (A DynamoDB service using eventually consistent global tables needs continued regional writes when an AWS Region is isolated): global tables provide multi-Region replicated writes with eventual consistency between Regions; client routing and conflict semantics still matter. The required design is design DynamoDB global tables with suitable conflict resolution and client routing considerations; acceptance depends on evidence that region-failure testing shows the surviving replica accepts writes and data converges as designed.

D would assume eventually consistent cross-Region replication prevents all simultaneous-write conflicts automatically. This is not a defensible answer to the stated constraint (A DynamoDB service using eventually consistent global tables needs continued regional writes when an AWS Region is isolated): global tables provide multi-Region replicated writes with eventual consistency between Regions; client routing and conflict semantics still matter. The required design is design DynamoDB global tables with suitable conflict resolution and client routing considerations; acceptance depends on evidence that region-failure testing shows the surviving replica accepts writes and data converges as designed.

A reports an inadequate or failed acceptance condition: Clients continue contacting the isolated Region and receive repeated write errors. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that region-failure testing shows the surviving replica accepts writes and data converges as designed. The underlying design requirement is global tables provide multi-Region replicated writes with eventual consistency between Regions; client routing and conflict semantics still matter.

C reports an inadequate or failed acceptance condition: Only the failed Region has a DynamoDB table capable of accepting writes. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that region-failure testing shows the surviving replica accepts writes and data converges as designed. The underlying design requirement is global tables provide multi-Region replicated writes with eventual consistency between Regions; client routing and conflict semantics still matter.

D reports an inadequate or failed acceptance condition: Both Regions accept simultaneous writes but the conflict resolution loses an expected update. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that region-failure testing shows the surviving replica accepts writes and data converges as designed. The underlying design requirement is global tables provide multi-Region replicated writes with eventual consistency between Regions; client routing and conflict semantics still matter.

A would enable EFS lifecycle transitions and treat them as a backup of deleted files. This is not a defensible answer to the stated constraint (An application uses an EFS file system and requires file-level recovery from accidental deletion): eFS multi-AZ durability does not replace backup against user deletion or corruption. The required design is configure AWS Backup point-in-time schedules for EFS with tested restore permissions and retention; acceptance depends on evidence that a deleted test directory can be restored with its expected file contents.

B would create a backup plan without granting the restore role permissions to recover EFS data. This is not a defensible answer to the stated constraint (An application uses an EFS file system and requires file-level recovery from accidental deletion): eFS multi-AZ durability does not replace backup against user deletion or corruption. The required design is configure AWS Backup point-in-time schedules for EFS with tested restore permissions and retention; acceptance depends on evidence that a deleted test directory can be restored with its expected file contents.

D would copy just EFS mount target settings and assume deleted directory contents can be reconstructed. This is not a defensible answer to the stated constraint (An application uses an EFS file system and requires file-level recovery from accidental deletion): eFS multi-AZ durability does not replace backup against user deletion or corruption. The required design is configure AWS Backup point-in-time schedules for EFS with tested restore permissions and retention; acceptance depends on evidence that a deleted test directory can be restored with its expected file contents.

A reports an inadequate or failed acceptance condition: An EFS lifecycle policy moves cold files but cannot restore the deliberately deleted directory. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a deleted test directory can be restored with its expected file contents. The underlying design requirement is eFS multi-AZ durability does not replace backup against user deletion or corruption.

B reports an inadequate or failed acceptance condition: AWS Backup shows a completed job but the restore role cannot read the recovery point. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a deleted test directory can be restored with its expected file contents. The underlying design requirement is eFS multi-AZ durability does not replace backup against user deletion or corruption.

C reports an inadequate or failed acceptance condition: The EFS mount targets are present while all deleted test files remain missing. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a deleted test directory can be restored with its expected file contents. The underlying design requirement is eFS multi-AZ durability does not replace backup against user deletion or corruption.

B would expose HTTP on the ALB without a valid HTTPS certificate or TLS listener. This is not a defensible answer to the stated constraint (An API must expose public HTTPS while preventing ordinary internet clients from reaching its private container tasks): private backend placement and SG references enforce the tier boundary beyond URL-level controls. The required design is use an internet-facing ALB with HTTPS listeners and private-subnet task targets protected by security groups; acceptance depends on evidence that only ALB security-group traffic reaches the target ports and public clients negotiate valid TLS.

C would use an internal-only ALB and assume ordinary internet clients can reach its private endpoint. This is not a defensible answer to the stated constraint (An API must expose public HTTPS while preventing ordinary internet clients from reaching its private container tasks): private backend placement and SG references enforce the tier boundary beyond URL-level controls. The required design is use an internet-facing ALB with HTTPS listeners and private-subnet task targets protected by security groups; acceptance depends on evidence that only ALB security-group traffic reaches the target ports and public clients negotiate valid TLS.

D would place Fargate tasks in public subnets with public IPs and unrestricted inbound target rules. This is not a defensible answer to the stated constraint (An API must expose public HTTPS while preventing ordinary internet clients from reaching its private container tasks): private backend placement and SG references enforce the tier boundary beyond URL-level controls. The required design is use an internet-facing ALB with HTTPS listeners and private-subnet task targets protected by security groups; acceptance depends on evidence that only ALB security-group traffic reaches the target ports and public clients negotiate valid TLS.

A reports an inadequate or failed acceptance condition: Public clients reach the ALB by HTTP while its expected HTTPS certificate handshake fails. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that only ALB security-group traffic reaches the target ports and public clients negotiate valid TLS. The underlying design requirement is private backend placement and SG references enforce the tier boundary beyond URL-level controls.

C reports an inadequate or failed acceptance condition: An internal ALB serves test clients inside the VPC but is unreachable from public networks. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that only ALB security-group traffic reaches the target ports and public clients negotiate valid TLS. The underlying design requirement is private backend placement and SG references enforce the tier boundary beyond URL-level controls.

D reports an inadequate or failed acceptance condition: Fargate task ENIs allow inbound traffic directly from arbitrary internet IP addresses. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that only ALB security-group traffic reaches the target ports and public clients negotiate valid TLS. The underlying design requirement is private backend placement and SG references enforce the tier boundary beyond URL-level controls.

A would set a WAF monitor-only rule for abusive traffic while claiming the origin is actively protected. This is not a defensible answer to the stated constraint (A public API receives Layer 7 bot and injection traffic but also needs managed DDoS protection): wAF filters HTTP request patterns; Shield addresses DDoS classes rather than SQL injection alone. The required design is attach AWS WAF web ACL rules to the CloudFront distribution and evaluate Shield Advanced where risk warrants; acceptance depends on evidence that wAF sampled requests show blocked application attacks and edge protection events are visible.

B would configure Shield standard only and expect it to replace Layer 7 WAF rules for SQL injection. This is not a defensible answer to the stated constraint (A public API receives Layer 7 bot and injection traffic but also needs managed DDoS protection): wAF filters HTTP request patterns; Shield addresses DDoS classes rather than SQL injection alone. The required design is attach AWS WAF web ACL rules to the CloudFront distribution and evaluate Shield Advanced where risk warrants; acceptance depends on evidence that wAF sampled requests show blocked application attacks and edge protection events are visible.

D would attach a WAF web ACL to a resource other than the active CloudFront distribution. This is not a defensible answer to the stated constraint (A public API receives Layer 7 bot and injection traffic but also needs managed DDoS protection): wAF filters HTTP request patterns; Shield addresses DDoS classes rather than SQL injection alone. The required design is attach AWS WAF web ACL rules to the CloudFront distribution and evaluate Shield Advanced where risk warrants; acceptance depends on evidence that wAF sampled requests show blocked application attacks and edge protection events are visible.

A reports an inadequate or failed acceptance condition: Only COUNT actions are recorded for malicious requests that should be blocked or challenged. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that wAF sampled requests show blocked application attacks and edge protection events are visible. The underlying design requirement is wAF filters HTTP request patterns; Shield addresses DDoS classes rather than SQL injection alone.

B reports an inadequate or failed acceptance condition: Shield logs report network protection while SQL injection requests reach the origin unblocked. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that wAF sampled requests show blocked application attacks and edge protection events are visible. The underlying design requirement is wAF filters HTTP request patterns; Shield addresses DDoS classes rather than SQL injection alone.

C reports an inadequate or failed acceptance condition: WAF rule metrics increase on a staging distribution instead of the active production distribution. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that wAF sampled requests show blocked application attacks and edge protection events are visible. The underlying design requirement is wAF filters HTTP request patterns; Shield addresses DDoS classes rather than SQL injection alone.

B would grant S3 GetObject without corresponding customer KMS key authorization for the partner. This is not a defensible answer to the stated constraint (A company encrypts a cross-account S3 dataset using a customer-managed KMS key and must grant a partner read access): s3 object access and KMS decrypt are separate authorization planes for SSE-KMS data. The required design is configure least-privilege bucket policy, partner principal IAM rights, and KMS key-use authorization; acceptance depends on evidence that the partner principal reads only approved objects and receives decrypt permission without broad key administration.

C would share KMS key administrator privileges broadly to allow one partner to decrypt selected objects. This is not a defensible answer to the stated constraint (A company encrypts a cross-account S3 dataset using a customer-managed KMS key and must grant a partner read access): s3 object access and KMS decrypt are separate authorization planes for SSE-KMS data. The required design is configure least-privilege bucket policy, partner principal IAM rights, and KMS key-use authorization; acceptance depends on evidence that the partner principal reads only approved objects and receives decrypt permission without broad key administration.

D would grant KMS Decrypt alone but leave the S3 bucket policy denying partner object access. This is not a defensible answer to the stated constraint (A company encrypts a cross-account S3 dataset using a customer-managed KMS key and must grant a partner read access): s3 object access and KMS decrypt are separate authorization planes for SSE-KMS data. The required design is configure least-privilege bucket policy, partner principal IAM rights, and KMS key-use authorization; acceptance depends on evidence that the partner principal reads only approved objects and receives decrypt permission without broad key administration.

A reports an inadequate or failed acceptance condition: S3 bucket authorization succeeds but the partner receives KMS Decrypt AccessDenied. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that the partner principal reads only approved objects and receives decrypt permission without broad key administration. The underlying design requirement is s3 object access and KMS decrypt are separate authorization planes for SSE-KMS data.

C reports an inadequate or failed acceptance condition: Partner principal can administer the entire KMS key despite needing only object decryption. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that the partner principal reads only approved objects and receives decrypt permission without broad key administration. The underlying design requirement is s3 object access and KMS decrypt are separate authorization planes for SSE-KMS data.

D reports an inadequate or failed acceptance condition: KMS calls succeed while bucket GetObject remains denied for the intended partner. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that the partner principal reads only approved objects and receives decrypt permission without broad key administration. The underlying design requirement is s3 object access and KMS decrypt are separate authorization planes for SSE-KMS data.