A reports an inadequate or failed acceptance condition: Gateway endpoint route tables cover one test subnet but not the private workload subnets. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that nAT processed-byte metrics decline while service calls succeed without internet routes. The underlying design requirement is gateway endpoints avoid per-byte NAT processing for eligible regional S3 and DynamoDB traffic.

B reports an inadequate or failed acceptance condition: The application S3 calls still traverse NAT and its processed-byte bill is unchanged. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that nAT processed-byte metrics decline while service calls succeed without internet routes. The underlying design requirement is gateway endpoints avoid per-byte NAT processing for eligible regional S3 and DynamoDB traffic.

C reports an inadequate or failed acceptance condition: An endpoint for a different service reports Available but S3 and DynamoDB traffic bypass it. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that nAT processed-byte metrics decline while service calls succeed without internet routes. The underlying design requirement is gateway endpoints avoid per-byte NAT processing for eligible regional S3 and DynamoDB traffic.

B would raise the threshold for all EC2 CPU alerts without correlating them to customer-visible symptoms. This is not a defensible answer to the stated constraint (An operating team receives thousands of identical EC2 saturation alarms but cannot identify affected user transactions): application observability connects symptoms to traces; a raw host metric alone cannot identify a failing request path. The required design is use CloudWatch metrics and alarms combined with distributed tracing and service-level dashboards; acceptance depends on evidence that on-call staff correlate an SLO breach with affected dependencies and reduce duplicate incident noise.

C would collect raw metrics only and omit distributed traces spanning the failing transactions. This is not a defensible answer to the stated constraint (An operating team receives thousands of identical EC2 saturation alarms but cannot identify affected user transactions): application observability connects symptoms to traces; a raw host metric alone cannot identify a failing request path. The required design is use CloudWatch metrics and alarms combined with distributed tracing and service-level dashboards; acceptance depends on evidence that on-call staff correlate an SLO breach with affected dependencies and reduce duplicate incident noise.

D would page responders on every host alarm independently without service-level deduplication or dashboards. This is not a defensible answer to the stated constraint (An operating team receives thousands of identical EC2 saturation alarms but cannot identify affected user transactions): application observability connects symptoms to traces; a raw host metric alone cannot identify a failing request path. The required design is use CloudWatch metrics and alarms combined with distributed tracing and service-level dashboards; acceptance depends on evidence that on-call staff correlate an SLO breach with affected dependencies and reduce duplicate incident noise.

A reports an inadequate or failed acceptance condition: EC2 saturation alerts continue to page on every instance with no customer trace correlation. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that on-call staff correlate an SLO breach with affected dependencies and reduce duplicate incident noise. The underlying design requirement is application observability connects symptoms to traces; a raw host metric alone cannot identify a failing request path.

C reports an inadequate or failed acceptance condition: CloudWatch metrics are recorded, but an affected transaction has no end-to-end span context. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that on-call staff correlate an SLO breach with affected dependencies and reduce duplicate incident noise. The underlying design requirement is application observability connects symptoms to traces; a raw host metric alone cannot identify a failing request path.

D reports an inadequate or failed acceptance condition: The SLO alert is disabled to reduce noise and user-impact incidents go unnoticed. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that on-call staff correlate an SLO breach with affected dependencies and reduce duplicate incident noise. The underlying design requirement is application observability connects symptoms to traces; a raw host metric alone cannot identify a failing request path.

A would patch only a randomly selected development subset and assume all 150 accounts are covered. This is not a defensible answer to the stated constraint (A 150-account organization needs consistent OS updates during approved weekend windows): patch Manager enforces repeatable patch schedules; an emailed maintenance checklist does not establish compliance. The required design is run Systems Manager Patch Manager with organization controls, maintenance windows, and patch baselines; acceptance depends on evidence that patch compliance reports show expected releases installed across scoped managed instances.

B would require SSH manual updates by every administrator rather than centrally tracked Systems Manager actions. This is not a defensible answer to the stated constraint (A 150-account organization needs consistent OS updates during approved weekend windows): patch Manager enforces repeatable patch schedules; an emailed maintenance checklist does not establish compliance. The required design is run Systems Manager Patch Manager with organization controls, maintenance windows, and patch baselines; acceptance depends on evidence that patch compliance reports show expected releases installed across scoped managed instances.

D would configure patch baselines but never enable agent enrollment or weekend maintenance windows. This is not a defensible answer to the stated constraint (A 150-account organization needs consistent OS updates during approved weekend windows): patch Manager enforces repeatable patch schedules; an emailed maintenance checklist does not establish compliance. The required design is run Systems Manager Patch Manager with organization controls, maintenance windows, and patch baselines; acceptance depends on evidence that patch compliance reports show expected releases installed across scoped managed instances.

A reports an inadequate or failed acceptance condition: 150 managed-node associations exist but many hosts never execute the weekend maintenance window. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that patch compliance reports show expected releases installed across scoped managed instances. The underlying design requirement is patch Manager enforces repeatable patch schedules; an emailed maintenance checklist does not establish compliance.

B reports an inadequate or failed acceptance condition: Patch commands fail on newly created nodes lacking appropriate Systems Manager roles. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that patch compliance reports show expected releases installed across scoped managed instances. The underlying design requirement is patch Manager enforces repeatable patch schedules; an emailed maintenance checklist does not establish compliance.

C reports an inadequate or failed acceptance condition: Patch compliance shows green only in one development account rather than all required scopes. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that patch compliance reports show expected releases installed across scoped managed instances. The underlying design requirement is patch Manager enforces repeatable patch schedules; an emailed maintenance checklist does not establish compliance.

B would ignore resource changes made outside the pipeline because recent stack updates completed successfully. This is not a defensible answer to the stated constraint (A microservice team cannot explain resource changes made outside its CloudFormation pipeline): configuration history shows state changes while drift compares them with intended IaC resources. The required design is combine CloudFormation drift detection with AWS Config configuration history and change control; acceptance depends on evidence that drift reports identify manual deviations and change history links the resource state to authorized work.

C would validate the CloudFormation template syntax but never compare deployed resource drift. This is not a defensible answer to the stated constraint (A microservice team cannot explain resource changes made outside its CloudFormation pipeline): configuration history shows state changes while drift compares them with intended IaC resources. The required design is combine CloudFormation drift detection with AWS Config configuration history and change control; acceptance depends on evidence that drift reports identify manual deviations and change history links the resource state to authorized work.

D would use Cost Explorer billing changes as the primary record of unauthorized configuration edits. This is not a defensible answer to the stated constraint (A microservice team cannot explain resource changes made outside its CloudFormation pipeline): configuration history shows state changes while drift compares them with intended IaC resources. The required design is combine CloudFormation drift detection with AWS Config configuration history and change control; acceptance depends on evidence that drift reports identify manual deviations and change history links the resource state to authorized work.

A reports an inadequate or failed acceptance condition: Drift detection runs on a different stack and finds no evidence of the actual change. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that drift reports identify manual deviations and change history links the resource state to authorized work. The underlying design requirement is configuration history shows state changes while drift compares them with intended IaC resources.

C reports an inadequate or failed acceptance condition: Template syntax checks pass even though a manually changed route remains present. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that drift reports identify manual deviations and change history links the resource state to authorized work. The underlying design requirement is configuration history shows state changes while drift compares them with intended IaC resources.

D reports an inadequate or failed acceptance condition: The change ticket is approved, but AWS Config still records an unreviewed resource modification. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that drift reports identify manual deviations and change history links the resource state to authorized work. The underlying design requirement is configuration history shows state changes while drift compares them with intended IaC resources.

A would keep an unbounded manual restart procedure with no observable alarm-driven trigger. This is not a defensible answer to the stated constraint (An incident recurs every week because staff manually restart a failed application process): automated remediation converts a known safe operational response into a reproducible event-driven action. The required design is use an EventBridge rule or CloudWatch alarm to invoke a bounded Systems Manager Automation runbook; acceptance depends on evidence that a controlled failure triggers a documented recovery run with successful post-action health checks.

B would invoke the recovery script on every low-priority alarm even if the app is currently healthy. This is not a defensible answer to the stated constraint (An incident recurs every week because staff manually restart a failed application process): automated remediation converts a known safe operational response into a reproducible event-driven action. The required design is use an EventBridge rule or CloudWatch alarm to invoke a bounded Systems Manager Automation runbook; acceptance depends on evidence that a controlled failure triggers a documented recovery run with successful post-action health checks.

D would run automated restarts without post-action health tests, limits, or audit execution evidence. This is not a defensible answer to the stated constraint (An incident recurs every week because staff manually restart a failed application process): automated remediation converts a known safe operational response into a reproducible event-driven action. The required design is use an EventBridge rule or CloudWatch alarm to invoke a bounded Systems Manager Automation runbook; acceptance depends on evidence that a controlled failure triggers a documented recovery run with successful post-action health checks.

A reports an inadequate or failed acceptance condition: Staff still restart the failed process manually after the same alarm recurs. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a controlled failure triggers a documented recovery run with successful post-action health checks. The underlying design requirement is automated remediation converts a known safe operational response into a reproducible event-driven action.

B reports an inadequate or failed acceptance condition: An automation runs on every benign alarm and restarts healthy application processes. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a controlled failure triggers a documented recovery run with successful post-action health checks. The underlying design requirement is automated remediation converts a known safe operational response into a reproducible event-driven action.

C reports an inadequate or failed acceptance condition: The runbook completes but the target process fails its post-recovery health check. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a controlled failure triggers a documented recovery run with successful post-action health checks. The underlying design requirement is automated remediation converts a known safe operational response into a reproducible event-driven action.

B would run disruptive failure experiments with no safety stop conditions or business acceptance limits. This is not a defensible answer to the stated constraint (A web service has no evidence that its disaster-recovery scripts still work after monthly deployments): failure rehearsals validate recovery assumptions; an untested runbook is not proof of resilience. The required design is introduce scheduled game days and AWS Fault Injection Service experiments with explicit stop conditions; acceptance depends on evidence that post-experiment records show observed recovery time and remediation for missed targets.

C would test only the predeployment image and assume later monthly deployments cannot break DR dependencies. This is not a defensible answer to the stated constraint (A web service has no evidence that its disaster-recovery scripts still work after monthly deployments): failure rehearsals validate recovery assumptions; an untested runbook is not proof of resilience. The required design is introduce scheduled game days and AWS Fault Injection Service experiments with explicit stop conditions; acceptance depends on evidence that post-experiment records show observed recovery time and remediation for missed targets.

D would approve disaster recovery solely because the runbook is stored in version control. This is not a defensible answer to the stated constraint (A web service has no evidence that its disaster-recovery scripts still work after monthly deployments): failure rehearsals validate recovery assumptions; an untested runbook is not proof of resilience. The required design is introduce scheduled game days and AWS Fault Injection Service experiments with explicit stop conditions; acceptance depends on evidence that post-experiment records show observed recovery time and remediation for missed targets.

A reports an inadequate or failed acceptance condition: The simulated failure is allowed to exceed safety stop criteria without control. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that post-experiment records show observed recovery time and remediation for missed targets. The underlying design requirement is failure rehearsals validate recovery assumptions; an untested runbook is not proof of resilience.

C reports an inadequate or failed acceptance condition: A successful pre-release test is treated as proof after several untested new deployments. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that post-experiment records show observed recovery time and remediation for missed targets. The underlying design requirement is failure rehearsals validate recovery assumptions; an untested runbook is not proof of resilience.

D reports an inadequate or failed acceptance condition: A runbook document is current but no fault-injection drill measures recovery. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that post-experiment records show observed recovery time and remediation for missed targets. The underlying design requirement is failure rehearsals validate recovery assumptions; an untested runbook is not proof of resilience.