A reports an inadequate or failed acceptance condition: The baseline is listed but installed patch compliance remains below the required fleet threshold. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that fleet compliance reports show installed approved patches and no inbound SSH administrative ports. The underlying design requirement is sSM agents and IAM offer centralized patch operations rather than unrestricted network administration.

B reports an inadequate or failed acceptance condition: Instances can be patched only after operators open public inbound SSH. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that fleet compliance reports show installed approved patches and no inbound SSH administrative ports. The underlying design requirement is sSM agents and IAM offer centralized patch operations rather than unrestricted network administration.

C reports an inadequate or failed acceptance condition: Patch Manager execution cannot contact or authenticate the managed instances. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that fleet compliance reports show installed approved patches and no inbound SSH administrative ports. The underlying design requirement is sSM agents and IAM offer centralized patch operations rather than unrestricted network administration.

B would direct every spoke's default route through a NAT gateway without an inspection appliance service chain. This is not a defensible answer to the stated constraint (Security operations needs to inspect traffic exiting spoke VPCs across multiple accounts): gateway Load Balancer inserts compatible firewalls into network paths; NAT gateways do not inspect application threats. The required design is centralize inspection through Gateway Load Balancer endpoints and a designed transit routing pattern; acceptance depends on evidence that flow tests traverse the inspection appliance fleet without introducing asymmetric return paths.

C would deploy Gateway Load Balancer appliances but allow asymmetric return paths through unrelated AZ endpoints. This is not a defensible answer to the stated constraint (Security operations needs to inspect traffic exiting spoke VPCs across multiple accounts): gateway Load Balancer inserts compatible firewalls into network paths; NAT gateways do not inspect application threats. The required design is centralize inspection through Gateway Load Balancer endpoints and a designed transit routing pattern; acceptance depends on evidence that flow tests traverse the inspection appliance fleet without introducing asymmetric return paths.

D would use security-group rules alone as a central deep packet-inspection service for traffic crossing accounts. This is not a defensible answer to the stated constraint (Security operations needs to inspect traffic exiting spoke VPCs across multiple accounts): gateway Load Balancer inserts compatible firewalls into network paths; NAT gateways do not inspect application threats. The required design is centralize inspection through Gateway Load Balancer endpoints and a designed transit routing pattern; acceptance depends on evidence that flow tests traverse the inspection appliance fleet without introducing asymmetric return paths.

A reports an inadequate or failed acceptance condition: NAT connection counters rise but no GWLB inspection appliance sees the spoke traffic. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that flow tests traverse the inspection appliance fleet without introducing asymmetric return paths. The underlying design requirement is gateway Load Balancer inserts compatible firewalls into network paths; NAT gateways do not inspect application threats.

C reports an inadequate or failed acceptance condition: Some packets traverse the appliance, but asymmetric return flows fail session inspection. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that flow tests traverse the inspection appliance fleet without introducing asymmetric return paths. The underlying design requirement is gateway Load Balancer inserts compatible firewalls into network paths; NAT gateways do not inspect application threats.

D reports an inadequate or failed acceptance condition: A security group denies one port yet uninspected permitted traffic still leaves spoke accounts. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that flow tests traverse the inspection appliance fleet without introducing asymmetric return paths. The underlying design requirement is gateway Load Balancer inserts compatible firewalls into network paths; NAT gateways do not inspect application threats.

A would configure a fixed IP allowlist only and assume it addresses distributed abusive request rates. This is not a defensible answer to the stated constraint (A mobile API must reject excessive unauthenticated request rates close to users): edge rate limiting limits unwanted workload traffic more efficiently than only scaling the backend. The required design is implement rate-based AWS WAF rules on CloudFront or an appropriate public API integration; acceptance depends on evidence that high-rate abusive requests receive block or challenge actions before reaching the origin.

B would deploy WAF rate rules but never associate them with the active public CloudFront/API entry point. This is not a defensible answer to the stated constraint (A mobile API must reject excessive unauthenticated request rates close to users): edge rate limiting limits unwanted workload traffic more efficiently than only scaling the backend. The required design is implement rate-based AWS WAF rules on CloudFront or an appropriate public API integration; acceptance depends on evidence that high-rate abusive requests receive block or challenge actions before reaching the origin.

D would use application logs to manually block bots after high-rate requests have hit the origin. This is not a defensible answer to the stated constraint (A mobile API must reject excessive unauthenticated request rates close to users): edge rate limiting limits unwanted workload traffic more efficiently than only scaling the backend. The required design is implement rate-based AWS WAF rules on CloudFront or an appropriate public API integration; acceptance depends on evidence that high-rate abusive requests receive block or challenge actions before reaching the origin.

A reports an inadequate or failed acceptance condition: The same bot rotates source addresses and bypasses a static allowlist. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that high-rate abusive requests receive block or challenge actions before reaching the origin. The underlying design requirement is edge rate limiting limits unwanted workload traffic more efficiently than only scaling the backend.

B reports an inadequate or failed acceptance condition: The WAF rate rule exists on an unattached web ACL while the origin remains overloaded. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that high-rate abusive requests receive block or challenge actions before reaching the origin. The underlying design requirement is edge rate limiting limits unwanted workload traffic more efficiently than only scaling the backend.

C reports an inadequate or failed acceptance condition: Application log filters flag abusive IPs only after rate bursts reach the backend. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that high-rate abusive requests receive block or challenge actions before reaching the origin. The underlying design requirement is edge rate limiting limits unwanted workload traffic more efficiently than only scaling the backend.

B would set the Auto Scaling desired capacity to zero during a zonal incident and rely on DNS alone. This is not a defensible answer to the stated constraint (A web tier handles sudden checkout bursts and must tolerate a whole AZ outage): multi-AZ target placement and health-driven replacement contain host and zonal failures. The required design is run stateless instances in an Auto Scaling group across at least two AZs behind an ALB; acceptance depends on evidence that a zonal failure leaves healthy registered targets in the other AZ and scaling restores capacity.

C would keep all checkout targets in one AZ behind a multi-AZ ALB. This is not a defensible answer to the stated constraint (A web tier handles sudden checkout bursts and must tolerate a whole AZ outage): multi-AZ target placement and health-driven replacement contain host and zonal failures. The required design is run stateless instances in an Auto Scaling group across at least two AZs behind an ALB; acceptance depends on evidence that a zonal failure leaves healthy registered targets in the other AZ and scaling restores capacity.

D would use a single non-scaling EC2 instance with a higher instance size as the sole high-availability strategy. This is not a defensible answer to the stated constraint (A web tier handles sudden checkout bursts and must tolerate a whole AZ outage): multi-AZ target placement and health-driven replacement contain host and zonal failures. The required design is run stateless instances in an Auto Scaling group across at least two AZs behind an ALB; acceptance depends on evidence that a zonal failure leaves healthy registered targets in the other AZ and scaling restores capacity.

A reports an inadequate or failed acceptance condition: The remaining AZ has no target capacity when a failure drill removes the other AZ. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a zonal failure leaves healthy registered targets in the other AZ and scaling restores capacity. The underlying design requirement is multi-AZ target placement and health-driven replacement contain host and zonal failures.

C reports an inadequate or failed acceptance condition: The ALB is deployed across two AZs but all healthy checkout targets are in the failing one. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a zonal failure leaves healthy registered targets in the other AZ and scaling restores capacity. The underlying design requirement is multi-AZ target placement and health-driven replacement contain host and zonal failures.

D reports an inadequate or failed acceptance condition: A single large EC2 instance serves checkout until its AZ becomes unavailable. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a zonal failure leaves healthy registered targets in the other AZ and scaling restores capacity. The underlying design requirement is multi-AZ target placement and health-driven replacement contain host and zonal failures.

A would place pending order messages only in RAM on worker instances. This is not a defensible answer to the stated constraint (An order-processing system loses messages when a database transaction fails midway): at-least-once delivery requires idempotency rather than assuming every message appears exactly once. The required design is use SQS durable queuing with idempotent handlers and a configured DLQ after retry limits; acceptance depends on evidence that a replay of the same order identifier produces one committed order, and poison messages enter the DLQ.

B would retry order submissions without deduplicating an already committed order identifier. This is not a defensible answer to the stated constraint (An order-processing system loses messages when a database transaction fails midway): at-least-once delivery requires idempotency rather than assuming every message appears exactly once. The required design is use SQS durable queuing with idempotent handlers and a configured DLQ after retry limits; acceptance depends on evidence that a replay of the same order identifier produces one committed order, and poison messages enter the DLQ.

D would discard poison messages immediately without a configured dead-letter queue or retry policy. This is not a defensible answer to the stated constraint (An order-processing system loses messages when a database transaction fails midway): at-least-once delivery requires idempotency rather than assuming every message appears exactly once. The required design is use SQS durable queuing with idempotent handlers and a configured DLQ after retry limits; acceptance depends on evidence that a replay of the same order identifier produces one committed order, and poison messages enter the DLQ.

A reports an inadequate or failed acceptance condition: An instance restart erases unacknowledged orders from its volatile queue. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a replay of the same order identifier produces one committed order, and poison messages enter the DLQ. The underlying design requirement is at-least-once delivery requires idempotency rather than assuming every message appears exactly once.

B reports an inadequate or failed acceptance condition: A replay of an order identifier creates a second financial transaction. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a replay of the same order identifier produces one committed order, and poison messages enter the DLQ. The underlying design requirement is at-least-once delivery requires idempotency rather than assuming every message appears exactly once.

C reports an inadequate or failed acceptance condition: A poison message disappears without a DLQ record or retry trace. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a replay of the same order identifier produces one committed order, and poison messages enter the DLQ. The underlying design requirement is at-least-once delivery requires idempotency rather than assuming every message appears exactly once.

B would increase request timeouts indefinitely, tying up all available web worker threads. This is not a defensible answer to the stated constraint (An API calls three downstream services and cascading failures exhaust request threads during a partial outage): unbounded synchronous retries amplify failure; timeout and jitter policies contain retry storms. The required design is apply bounded timeouts, exponential backoff with jitter, and circuit-breaker behavior; acceptance depends on evidence that load testing shows limited concurrent retries and continuing service for unaffected dependencies.

C would use an application-level circuit breaker that never opens when dependency failures surge. This is not a defensible answer to the stated constraint (An API calls three downstream services and cascading failures exhaust request threads during a partial outage): unbounded synchronous retries amplify failure; timeout and jitter policies contain retry storms. The required design is apply bounded timeouts, exponential backoff with jitter, and circuit-breaker behavior; acceptance depends on evidence that load testing shows limited concurrent retries and continuing service for unaffected dependencies.

D would set unlimited retries with zero delay against every degraded downstream API. This is not a defensible answer to the stated constraint (An API calls three downstream services and cascading failures exhaust request threads during a partial outage): unbounded synchronous retries amplify failure; timeout and jitter policies contain retry storms. The required design is apply bounded timeouts, exponential backoff with jitter, and circuit-breaker behavior; acceptance depends on evidence that load testing shows limited concurrent retries and continuing service for unaffected dependencies.

A reports an inadequate or failed acceptance condition: The API's request threads remain held indefinitely waiting for a stalled dependency. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that load testing shows limited concurrent retries and continuing service for unaffected dependencies. The underlying design requirement is unbounded synchronous retries amplify failure; timeout and jitter policies contain retry storms.

C reports an inadequate or failed acceptance condition: A circuit breaker records failures but continues allowing every request into the unavailable downstream service. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that load testing shows limited concurrent retries and continuing service for unaffected dependencies. The underlying design requirement is unbounded synchronous retries amplify failure; timeout and jitter policies contain retry storms.

D reports an inadequate or failed acceptance condition: Retry request volume grows without bound as downstream error rates increase. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that load testing shows limited concurrent retries and continuing service for unaffected dependencies. The underlying design requirement is unbounded synchronous retries amplify failure; timeout and jitter policies contain retry storms.