A reports an inadequate or failed acceptance condition: CPU alarms page the team during healthy service while user-facing failures have no alert. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an incident drill pages on objective violations and routes responders to relevant recovery actions. The underlying design requirement is business-service symptoms make better operational alerts than treating every resource utilization increase as failure.

B reports an inadequate or failed acceptance condition: An SLO document exists, but error-budget violations do not trigger paging. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an incident drill pages on objective violations and routes responders to relevant recovery actions. The underlying design requirement is business-service symptoms make better operational alerts than treating every resource utilization increase as failure.

C reports an inadequate or failed acceptance condition: A latency chart identifies a problem but the responders receive no runbook or actionable incident link. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an incident drill pages on objective violations and routes responders to relevant recovery actions. The underlying design requirement is business-service symptoms make better operational alerts than treating every resource utilization increase as failure.

B would store credentials in Secrets Manager but grant all developer instances unrestricted retrieval. This is not a defensible answer to the stated constraint (An inherited application stores production database passwords in EC2 user-data scripts): instance user data is not a proper secrets vault and can be exposed to authorized instance operators. The required design is move secrets to Secrets Manager and grant narrow retrieval roles without broad Describe permissions; acceptance depends on evidence that a repository and instance metadata inspection finds no plaintext password while credential retrieval works.

C would remove the password from the repository while leaving it accessible in EC2 user-data history. This is not a defensible answer to the stated constraint (An inherited application stores production database passwords in EC2 user-data scripts): instance user data is not a proper secrets vault and can be exposed to authorized instance operators. The required design is move secrets to Secrets Manager and grant narrow retrieval roles without broad Describe permissions; acceptance depends on evidence that a repository and instance metadata inspection finds no plaintext password while credential retrieval works.

D would move database passwords from user data into an unencrypted AMI image layer. This is not a defensible answer to the stated constraint (An inherited application stores production database passwords in EC2 user-data scripts): instance user data is not a proper secrets vault and can be exposed to authorized instance operators. The required design is move secrets to Secrets Manager and grant narrow retrieval roles without broad Describe permissions; acceptance depends on evidence that a repository and instance metadata inspection finds no plaintext password while credential retrieval works.

A reports an inadequate or failed acceptance condition: A developer EC2 role can read the production credential despite not needing it. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a repository and instance metadata inspection finds no plaintext password while credential retrieval works. The underlying design requirement is instance user data is not a proper secrets vault and can be exposed to authorized instance operators.

C reports an inadequate or failed acceptance condition: The encrypted AMI layer still exposes a plaintext credential at runtime to the wrong principals. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a repository and instance metadata inspection finds no plaintext password while credential retrieval works. The underlying design requirement is instance user data is not a proper secrets vault and can be exposed to authorized instance operators.

D reports an inadequate or failed acceptance condition: A production database password still appears in EC2 user-data history. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a repository and instance metadata inspection finds no plaintext password while credential retrieval works. The underlying design requirement is instance user data is not a proper secrets vault and can be exposed to authorized instance operators.

A would grant AdministratorAccess to roles so the access analyzer no longer reports explicit-deny warnings. This is not a defensible answer to the stated constraint (An organization needs to identify IAM users and roles with permissions broader than actual usage): policy generation and access analysis can support least privilege; broad wildcard grants are not justified by convenience. The required design is analyze IAM Access Analyzer policy findings and last-accessed service data before refining policies; acceptance depends on evidence that an access simulation shows unneeded actions denied while required workload actions remain permitted.

B would remove all IAM permissions without checking which operations the workload still needs. This is not a defensible answer to the stated constraint (An organization needs to identify IAM users and roles with permissions broader than actual usage): policy generation and access analysis can support least privilege; broad wildcard grants are not justified by convenience. The required design is analyze IAM Access Analyzer policy findings and last-accessed service data before refining policies; acceptance depends on evidence that an access simulation shows unneeded actions denied while required workload actions remain permitted.

D would treat absence of API calls this week as proof that a permission can always be removed safely. This is not a defensible answer to the stated constraint (An organization needs to identify IAM users and roles with permissions broader than actual usage): policy generation and access analysis can support least privilege; broad wildcard grants are not justified by convenience. The required design is analyze IAM Access Analyzer policy findings and last-accessed service data before refining policies; acceptance depends on evidence that an access simulation shows unneeded actions denied while required workload actions remain permitted.

A reports an inadequate or failed acceptance condition: AdministratorAccess remains assigned while the access report still shows broad unused grants. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an access simulation shows unneeded actions denied while required workload actions remain permitted. The underlying design requirement is policy generation and access analysis can support least privilege; broad wildcard grants are not justified by convenience.

B reports an inadequate or failed acceptance condition: All administrative privileges are removed and the production workload cannot perform required actions. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an access simulation shows unneeded actions denied while required workload actions remain permitted. The underlying design requirement is policy generation and access analysis can support least privilege; broad wildcard grants are not justified by convenience.

C reports an inadequate or failed acceptance condition: The simulator blocks necessary S3 and KMS calls along with genuinely unused permissions. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an access simulation shows unneeded actions denied while required workload actions remain permitted. The underlying design requirement is policy generation and access analysis can support least privilege; broad wildcard grants are not justified by convenience.

B would export findings manually once a month and rely on each account to invent its own response workflow. This is not a defensible answer to the stated constraint (Security receives multiple GuardDuty detections but response actions differ across member accounts): threat findings need controlled remediation; automatically deleting all suspicious EC2 instances risks data loss. The required design is aggregate findings to a delegated administrator and trigger scoped EventBridge or automation workflows; acceptance depends on evidence that a known test finding creates a review case and invokes only approved containment steps.

C would allow delegated security automation to quarantine every account's resources with no approvals or scope. This is not a defensible answer to the stated constraint (Security receives multiple GuardDuty detections but response actions differ across member accounts): threat findings need controlled remediation; automatically deleting all suspicious EC2 instances risks data loss. The required design is aggregate findings to a delegated administrator and trigger scoped EventBridge or automation workflows; acceptance depends on evidence that a known test finding creates a review case and invokes only approved containment steps.

D would create centralized GuardDuty enrollment but do not route findings to a review/response pipeline. This is not a defensible answer to the stated constraint (Security receives multiple GuardDuty detections but response actions differ across member accounts): threat findings need controlled remediation; automatically deleting all suspicious EC2 instances risks data loss. The required design is aggregate findings to a delegated administrator and trigger scoped EventBridge or automation workflows; acceptance depends on evidence that a known test finding creates a review case and invokes only approved containment steps.

A reports an inadequate or failed acceptance condition: Only a monthly finding export is available when a known GuardDuty test fires. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a known test finding creates a review case and invokes only approved containment steps. The underlying design requirement is threat findings need controlled remediation; automatically deleting all suspicious EC2 instances risks data loss.

C reports an inadequate or failed acceptance condition: An automated action quarantines an unrelated account resource outside the approved scope. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a known test finding creates a review case and invokes only approved containment steps. The underlying design requirement is threat findings need controlled remediation; automatically deleting all suspicious EC2 instances risks data loss.

D reports an inadequate or failed acceptance condition: Delegated findings appear, but no reviewed case or configured response is generated. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a known test finding creates a review case and invokes only approved containment steps. The underlying design requirement is threat findings need controlled remediation; automatically deleting all suspicious EC2 instances risks data loss.

A would enable an ordinary backup vault with no retention lock or separate account safeguards. This is not a defensible answer to the stated constraint (A database backup exists but a compromised admin could erase all backup recovery points): isolated backup administration and immutable retention reduce ransomware-induced recovery loss. The required design is use a logically separated backup account and AWS Backup Vault Lock in compliance mode as appropriate; acceptance depends on evidence that an unauthorized delete attempt fails during required retention and permitted restores still succeed.

B would rely only on EBS snapshots owned by the admin who could erase the recovery points. This is not a defensible answer to the stated constraint (A database backup exists but a compromised admin could erase all backup recovery points): isolated backup administration and immutable retention reduce ransomware-induced recovery loss. The required design is use a logically separated backup account and AWS Backup Vault Lock in compliance mode as appropriate; acceptance depends on evidence that an unauthorized delete attempt fails during required retention and permitted restores still succeed.

D would store backup copies in the same production account with the same compromised admin permissions. This is not a defensible answer to the stated constraint (A database backup exists but a compromised admin could erase all backup recovery points): isolated backup administration and immutable retention reduce ransomware-induced recovery loss. The required design is use a logically separated backup account and AWS Backup Vault Lock in compliance mode as appropriate; acceptance depends on evidence that an unauthorized delete attempt fails during required retention and permitted restores still succeed.

A reports an inadequate or failed acceptance condition: Vault Lock is absent and retained backups can be removed before policy expiry. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an unauthorized delete attempt fails during required retention and permitted restores still succeed. The underlying design requirement is isolated backup administration and immutable retention reduce ransomware-induced recovery loss.

B reports an inadequate or failed acceptance condition: The attacker destroys every accessible same-account snapshot during a simulated compromise. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an unauthorized delete attempt fails during required retention and permitted restores still succeed. The underlying design requirement is isolated backup administration and immutable retention reduce ransomware-induced recovery loss.

C reports an inadequate or failed acceptance condition: The compromised production admin can delete the supposed backup vault recovery points. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an unauthorized delete attempt fails during required retention and permitted restores still succeed. The underlying design requirement is isolated backup administration and immutable retention reduce ransomware-induced recovery loss.

B would open inbound SSH to every new instance and substitute manual access for managed patch enrollment. This is not a defensible answer to the stated constraint (A fleet of EC2 hosts falls out of patch compliance whenever development teams create new instances): central patch management reduces update gaps created by manual host-by-host processes. The required design is use Systems Manager Patch Manager baselines, appropriate maintenance windows and compliance reporting; acceptance depends on evidence that newly enrolled nodes show patch status and an audited remediation process without inbound SSH.

C would install security updates only on the original EC2 fleet and exclude newly launched instances. This is not a defensible answer to the stated constraint (A fleet of EC2 hosts falls out of patch compliance whenever development teams create new instances): central patch management reduces update gaps created by manual host-by-host processes. The required design is use Systems Manager Patch Manager baselines, appropriate maintenance windows and compliance reporting; acceptance depends on evidence that newly enrolled nodes show patch status and an audited remediation process without inbound SSH.

D would use patch compliance reports without actually deploying a patch baseline or maintenance execution. This is not a defensible answer to the stated constraint (A fleet of EC2 hosts falls out of patch compliance whenever development teams create new instances): central patch management reduces update gaps created by manual host-by-host processes. The required design is use Systems Manager Patch Manager baselines, appropriate maintenance windows and compliance reporting; acceptance depends on evidence that newly enrolled nodes show patch status and an audited remediation process without inbound SSH.

A reports an inadequate or failed acceptance condition: An instance patch requires publicly reachable SSH even though it should be SSM-managed. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that newly enrolled nodes show patch status and an audited remediation process without inbound SSH. The underlying design requirement is central patch management reduces update gaps created by manual host-by-host processes.

C reports an inadequate or failed acceptance condition: The original machines report patched, but new instances are not covered by the baseline. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that newly enrolled nodes show patch status and an audited remediation process without inbound SSH. The underlying design requirement is central patch management reduces update gaps created by manual host-by-host processes.

D reports an inadequate or failed acceptance condition: A patch report exists, yet approved updates were never installed on sampled production nodes. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that newly enrolled nodes show patch status and an audited remediation process without inbound SSH. The underlying design requirement is central patch management reduces update gaps created by manual host-by-host processes.