A reports an inadequate or failed acceptance condition: The API's request threads remain held indefinitely waiting for a stalled dependency. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that load testing shows limited concurrent retries and continuing service for unaffected dependencies. The underlying design requirement is unbounded synchronous retries amplify failure; timeout and jitter policies contain retry storms.

C reports an inadequate or failed acceptance condition: A circuit breaker records failures but continues allowing every request into the unavailable downstream service. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that load testing shows limited concurrent retries and continuing service for unaffected dependencies. The underlying design requirement is unbounded synchronous retries amplify failure; timeout and jitter policies contain retry storms.

D reports an inadequate or failed acceptance condition: Retry request volume grows without bound as downstream error rates increase. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that load testing shows limited concurrent retries and continuing service for unaffected dependencies. The underlying design requirement is unbounded synchronous retries amplify failure; timeout and jitter policies contain retry storms.

A would enable partial batch responses but return the identifiers of successful messages as failures. This is not a defensible answer to the stated constraint (A Lambda consumer needs to process batches from SQS without replaying every successful record when one fails): partial batch failure responses reduce duplicate processing compared with failing the entire batch. The required design is configure partial batch response support and return only failed message identifiers; acceptance depends on evidence that successful records are deleted and only failed records are redelivered in the next batch.

B would return the entire SQS batch as failed after successfully processing all but one record. This is not a defensible answer to the stated constraint (A Lambda consumer needs to process batches from SQS without replaying every successful record when one fails): partial batch failure responses reduce duplicate processing compared with failing the entire batch. The required design is configure partial batch response support and return only failed message identifiers; acceptance depends on evidence that successful records are deleted and only failed records are redelivered in the next batch.

D would delete the complete batch when a single record fails and accept the resulting data loss. This is not a defensible answer to the stated constraint (A Lambda consumer needs to process batches from SQS without replaying every successful record when one fails): partial batch failure responses reduce duplicate processing compared with failing the entire batch. The required design is configure partial batch response support and return only failed message identifiers; acceptance depends on evidence that successful records are deleted and only failed records are redelivered in the next batch.

A reports an inadequate or failed acceptance condition: Successful messages are returned in the failed-item identifiers and are redelivered unnecessarily. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that successful records are deleted and only failed records are redelivered in the next batch. The underlying design requirement is partial batch failure responses reduce duplicate processing compared with failing the entire batch.

B reports an inadequate or failed acceptance condition: One invalid record causes previously successful messages to reappear in the SQS batch. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that successful records are deleted and only failed records are redelivered in the next batch. The underlying design requirement is partial batch failure responses reduce duplicate processing compared with failing the entire batch.

C reports an inadequate or failed acceptance condition: The failed message is removed from the queue with no opportunity to retry. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that successful records are deleted and only failed records are redelivered in the next batch. The underlying design requirement is partial batch failure responses reduce duplicate processing compared with failing the entire batch.

B would send writes to Aurora reader endpoints and assume replicas accept ordinary primary writes. This is not a defensible answer to the stated constraint (A service uses Aurora readers for queries but requires writes to follow a single primary writer): cluster endpoints abstract instance role changes, while direct instance endpoints can pin a failed writer. The required design is connect write traffic via the Aurora cluster writer endpoint and read traffic via reader endpoint as suitable; acceptance depends on evidence that after failover, application writes resolve to the promoted writer without hard-coded instance hostnames.

C would hard-code one instance hostname and never update it after writer failover. This is not a defensible answer to the stated constraint (A service uses Aurora readers for queries but requires writes to follow a single primary writer): cluster endpoints abstract instance role changes, while direct instance endpoints can pin a failed writer. The required design is connect write traffic via the Aurora cluster writer endpoint and read traffic via reader endpoint as suitable; acceptance depends on evidence that after failover, application writes resolve to the promoted writer without hard-coded instance hostnames.

D would direct all read-only traffic to the writer and assume this prevents writer contention. This is not a defensible answer to the stated constraint (A service uses Aurora readers for queries but requires writes to follow a single primary writer): cluster endpoints abstract instance role changes, while direct instance endpoints can pin a failed writer. The required design is connect write traffic via the Aurora cluster writer endpoint and read traffic via reader endpoint as suitable; acceptance depends on evidence that after failover, application writes resolve to the promoted writer without hard-coded instance hostnames.

A reports an inadequate or failed acceptance condition: An Aurora reader endpoint rejects write statements after a failover. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that after failover, application writes resolve to the promoted writer without hard-coded instance hostnames. The underlying design requirement is cluster endpoints abstract instance role changes, while direct instance endpoints can pin a failed writer.

C reports an inadequate or failed acceptance condition: The client tries the former writer's instance hostname and cannot reconnect to its replacement. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that after failover, application writes resolve to the promoted writer without hard-coded instance hostnames. The underlying design requirement is cluster endpoints abstract instance role changes, while direct instance endpoints can pin a failed writer.

D reports an inadequate or failed acceptance condition: The writer reaches peak CPU because all read-only queries still run on it. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that after failover, application writes resolve to the promoted writer without hard-coded instance hostnames. The underlying design requirement is cluster endpoints abstract instance role changes, while direct instance endpoints can pin a failed writer.

A would retry every failed task immediately forever with no bounded backoff or terminal state. This is not a defensible answer to the stated constraint (An event-driven workflow chains long-running retries and branching approvals without custom coordination servers): workflow orchestration provides explicit state and error handling rather than fragile chained callbacks. The required design is use Step Functions with durable state transitions, retry policies, and bounded execution controls; acceptance depends on evidence that execution history shows controlled branches and retry backoff with a final completion state.

B would run independent EventBridge rules without durable workflow correlation or execution history. This is not a defensible answer to the stated constraint (An event-driven workflow chains long-running retries and branching approvals without custom coordination servers): workflow orchestration provides explicit state and error handling rather than fragile chained callbacks. The required design is use Step Functions with durable state transitions, retry policies, and bounded execution controls; acceptance depends on evidence that execution history shows controlled branches and retry backoff with a final completion state.

D would implement approval waits only as memory state in one Lambda invocation that can time out. This is not a defensible answer to the stated constraint (An event-driven workflow chains long-running retries and branching approvals without custom coordination servers): workflow orchestration provides explicit state and error handling rather than fragile chained callbacks. The required design is use Step Functions with durable state transitions, retry policies, and bounded execution controls; acceptance depends on evidence that execution history shows controlled branches and retry backoff with a final completion state.

A reports an inadequate or failed acceptance condition: Retries occur infinitely without a bounded terminal failure state or backoff. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that execution history shows controlled branches and retry backoff with a final completion state. The underlying design requirement is workflow orchestration provides explicit state and error handling rather than fragile chained callbacks.

B reports an inadequate or failed acceptance condition: Different rule executions fire, but no single workflow history ties them to the same business request. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that execution history shows controlled branches and retry backoff with a final completion state. The underlying design requirement is workflow orchestration provides explicit state and error handling rather than fragile chained callbacks.

C reports an inadequate or failed acceptance condition: An approval request expires when the initiating Lambda's maximum runtime is reached. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that execution history shows controlled branches and retry backoff with a final completion state. The underlying design requirement is workflow orchestration provides explicit state and error handling rather than fragile chained callbacks.

B would add a cache layer with zero-hit keys and never measure database read reduction. This is not a defensible answer to the stated constraint (A highly trafficked catalog experiences repeated identical lookups that overload the relational database): a distributed cache absorbs repeated reads; TTL and invalidation preserve correctness of mutable data. The required design is add an appropriate cache-aside layer using ElastiCache and expiry/invalidation rules; acceptance depends on evidence that read load and p95 latency fall while updated prices are reflected after invalidation.

C would cache prices forever without invalidation or expiration controls. This is not a defensible answer to the stated constraint (A highly trafficked catalog experiences repeated identical lookups that overload the relational database): a distributed cache absorbs repeated reads; TTL and invalidation preserve correctness of mutable data. The required design is add an appropriate cache-aside layer using ElastiCache and expiry/invalidation rules; acceptance depends on evidence that read load and p95 latency fall while updated prices are reflected after invalidation.

D would place the relational database behind CloudFront and assume it caches arbitrary SQL queries. This is not a defensible answer to the stated constraint (A highly trafficked catalog experiences repeated identical lookups that overload the relational database): a distributed cache absorbs repeated reads; TTL and invalidation preserve correctness of mutable data. The required design is add an appropriate cache-aside layer using ElastiCache and expiry/invalidation rules; acceptance depends on evidence that read load and p95 latency fall while updated prices are reflected after invalidation.

A reports an inadequate or failed acceptance condition: The cache contains unique entries per request, leaving relational read utilization at its original peak. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that read load and p95 latency fall while updated prices are reflected after invalidation. The underlying design requirement is a distributed cache absorbs repeated reads; TTL and invalidation preserve correctness of mutable data.

C reports an inadequate or failed acceptance condition: Catalog prices remain stale after an authorized update and cache invalidation. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that read load and p95 latency fall while updated prices are reflected after invalidation. The underlying design requirement is a distributed cache absorbs repeated reads; TTL and invalidation preserve correctness of mutable data.

D reports an inadequate or failed acceptance condition: CloudFront content hit ratio rises while repeated database SELECT traffic stays unchanged. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that read load and p95 latency fall while updated prices are reflected after invalidation. The underlying design requirement is a distributed cache absorbs repeated reads; TTL and invalidation preserve correctness of mutable data.

A would use latency-based Route 53 records but do not configure health checks for failed Regions. This is not a defensible answer to the stated constraint (A global service must minimize latency while avoiding unhealthy regional deployments): latency-based DNS needs health awareness; region-local resources must exist before routing is effective. The required design is use Route 53 latency-based routing with health checks and region-local service capacity; acceptance depends on evidence that probes from distinct geographies resolve to healthy intended Regions and failed Regions stop receiving traffic.

B would send all clients to the geographically nearest Region even when the regional application is unhealthy. This is not a defensible answer to the stated constraint (A global service must minimize latency while avoiding unhealthy regional deployments): latency-based DNS needs health awareness; region-local resources must exist before routing is effective. The required design is use Route 53 latency-based routing with health checks and region-local service capacity; acceptance depends on evidence that probes from distinct geographies resolve to healthy intended Regions and failed Regions stop receiving traffic.

D would assume DNS latency routing creates regional application capacity without deployment in target Regions. This is not a defensible answer to the stated constraint (A global service must minimize latency while avoiding unhealthy regional deployments): latency-based DNS needs health awareness; region-local resources must exist before routing is effective. The required design is use Route 53 latency-based routing with health checks and region-local service capacity; acceptance depends on evidence that probes from distinct geographies resolve to healthy intended Regions and failed Regions stop receiving traffic.

A reports an inadequate or failed acceptance condition: Route 53 latency routing continues returning a failed Region that has no health check. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that probes from distinct geographies resolve to healthy intended Regions and failed Regions stop receiving traffic. The underlying design requirement is latency-based DNS needs health awareness; region-local resources must exist before routing is effective.

B reports an inadequate or failed acceptance condition: Clients near an unhealthy Region keep resolving to it despite available healthy Regions. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that probes from distinct geographies resolve to healthy intended Regions and failed Regions stop receiving traffic. The underlying design requirement is latency-based DNS needs health awareness; region-local resources must exist before routing is effective.

C reports an inadequate or failed acceptance condition: DNS returns a regional address with no deployed capacity to serve the clients. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that probes from distinct geographies resolve to healthy intended Regions and failed Regions stop receiving traffic. The underlying design requirement is latency-based DNS needs health awareness; region-local resources must exist before routing is effective.