A reports an inadequate or failed acceptance condition: An instance patch requires publicly reachable SSH even though it should be SSM-managed. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that newly enrolled nodes show patch status and an audited remediation process without inbound SSH. The underlying design requirement is central patch management reduces update gaps created by manual host-by-host processes.

C reports an inadequate or failed acceptance condition: The original machines report patched, but new instances are not covered by the baseline. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that newly enrolled nodes show patch status and an audited remediation process without inbound SSH. The underlying design requirement is central patch management reduces update gaps created by manual host-by-host processes.

D reports an inadequate or failed acceptance condition: A patch report exists, yet approved updates were never installed on sampled production nodes. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that newly enrolled nodes show patch status and an audited remediation process without inbound SSH. The underlying design requirement is central patch management reduces update gaps created by manual host-by-host processes.

A would enable CloudTrail management events only and assume S3 GetObject data access is covered. This is not a defensible answer to the stated constraint (Security must record both console actions and S3 object downloads across 80 accounts): s3 object reads require data-event coverage; management-event trails alone cannot explain individual downloads. The required design is enable organization CloudTrail management events and targeted S3 data events to a locked central log bucket; acceptance depends on evidence that a test GetObject and role change both appear in centrally accessible audit records.

B would enable S3 server access logs only and expect them to record all console role-change events. This is not a defensible answer to the stated constraint (Security must record both console actions and S3 object downloads across 80 accounts): s3 object reads require data-event coverage; management-event trails alone cannot explain individual downloads. The required design is enable organization CloudTrail management events and targeted S3 data events to a locked central log bucket; acceptance depends on evidence that a test GetObject and role change both appear in centrally accessible audit records.

D would deploy trails in one member account without an organization-wide central destination. This is not a defensible answer to the stated constraint (Security must record both console actions and S3 object downloads across 80 accounts): s3 object reads require data-event coverage; management-event trails alone cannot explain individual downloads. The required design is enable organization CloudTrail management events and targeted S3 data events to a locked central log bucket; acceptance depends on evidence that a test GetObject and role change both appear in centrally accessible audit records.

A reports an inadequate or failed acceptance condition: Role-change management events exist but a sampled S3 GetObject is missing from CloudTrail. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a test GetObject and role change both appear in centrally accessible audit records. The underlying design requirement is s3 object reads require data-event coverage; management-event trails alone cannot explain individual downloads.

B reports an inadequate or failed acceptance condition: S3 access logs record downloads but no console AssumeRole administrative activity. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a test GetObject and role change both appear in centrally accessible audit records. The underlying design requirement is s3 object reads require data-event coverage; management-event trails alone cannot explain individual downloads.

C reports an inadequate or failed acceptance condition: Only the parent account's trail receives events, not new member account data activity. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a test GetObject and role change both appear in centrally accessible audit records. The underlying design requirement is s3 object reads require data-event coverage; management-event trails alone cannot explain individual downloads.

B would block every outbound connection including required private service endpoints without an allowlist. This is not a defensible answer to the stated constraint (An existing workload allows unrestricted outbound traffic from sensitive application instances): least-privilege network egress limits exfiltration paths; outbound allow-all weakens segmentation. The required design is tighten security-group egress to approved endpoints and use VPC endpoints where practical; acceptance depends on evidence that vPC Flow Logs and application checks show only the documented permitted destination paths.

C would enable VPC Flow Logs alone but leave unrestricted egress rules unchanged. This is not a defensible answer to the stated constraint (An existing workload allows unrestricted outbound traffic from sensitive application instances): least-privilege network egress limits exfiltration paths; outbound allow-all weakens segmentation. The required design is tighten security-group egress to approved endpoints and use VPC endpoints where practical; acceptance depends on evidence that vPC Flow Logs and application checks show only the documented permitted destination paths.

D would remove all security-group egress restrictions and rely solely on broad VPC CIDR routes. This is not a defensible answer to the stated constraint (An existing workload allows unrestricted outbound traffic from sensitive application instances): least-privilege network egress limits exfiltration paths; outbound allow-all weakens segmentation. The required design is tighten security-group egress to approved endpoints and use VPC endpoints where practical; acceptance depends on evidence that vPC Flow Logs and application checks show only the documented permitted destination paths.

A reports an inadequate or failed acceptance condition: An allowed internal service call fails because the egress policy omitted its endpoint route. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that vPC Flow Logs and application checks show only the documented permitted destination paths. The underlying design requirement is least-privilege network egress limits exfiltration paths; outbound allow-all weakens segmentation.

C reports an inadequate or failed acceptance condition: VPC Flow Logs show all flows but security groups still authorize broad outbound access. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that vPC Flow Logs and application checks show only the documented permitted destination paths. The underlying design requirement is least-privilege network egress limits exfiltration paths; outbound allow-all weakens segmentation.

D reports an inadequate or failed acceptance condition: Sensitive instances still establish connections to arbitrary external IP destinations. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that vPC Flow Logs and application checks show only the documented permitted destination paths. The underlying design requirement is least-privilege network egress limits exfiltration paths; outbound allow-all weakens segmentation.

A would add an endpoint policy but leave a bucket resource policy that permits external access from other paths. This is not a defensible answer to the stated constraint (A sensitive S3 bucket allows access via the public endpoint even for permitted corporate roles): source endpoint conditions can restrict network origin in resource policies; endpoint policy alone cannot constrain all other routes. The required design is add a carefully scoped bucket policy condition for an expected VPC endpoint and test principal access; acceptance depends on evidence that calls from approved endpoint paths succeed and requests arriving outside them are denied.

B would restrict the bucket to IAM role ARNs without enforcing the required VPC endpoint path. This is not a defensible answer to the stated constraint (A sensitive S3 bucket allows access via the public endpoint even for permitted corporate roles): source endpoint conditions can restrict network origin in resource policies; endpoint policy alone cannot constrain all other routes. The required design is add a carefully scoped bucket policy condition for an expected VPC endpoint and test principal access; acceptance depends on evidence that calls from approved endpoint paths succeed and requests arriving outside them are denied.

D would use the aws:SourceIp public condition as if it identifies a private gateway endpoint reliably. This is not a defensible answer to the stated constraint (A sensitive S3 bucket allows access via the public endpoint even for permitted corporate roles): source endpoint conditions can restrict network origin in resource policies; endpoint policy alone cannot constrain all other routes. The required design is add a carefully scoped bucket policy condition for an expected VPC endpoint and test principal access; acceptance depends on evidence that calls from approved endpoint paths succeed and requests arriving outside them are denied.

A reports an inadequate or failed acceptance condition: The bucket accepts approved identities from outside the designated vpce restriction. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that calls from approved endpoint paths succeed and requests arriving outside them are denied. The underlying design requirement is source endpoint conditions can restrict network origin in resource policies; endpoint policy alone cannot constrain all other routes.

B reports an inadequate or failed acceptance condition: A corporate IAM principal can read the bucket through a public route rather than the required VPC endpoint. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that calls from approved endpoint paths succeed and requests arriving outside them are denied. The underlying design requirement is source endpoint conditions can restrict network origin in resource policies; endpoint policy alone cannot constrain all other routes.

C reports an inadequate or failed acceptance condition: A public IP matches a SourceIp rule but bypasses the intended endpoint-only path. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that calls from approved endpoint paths succeed and requests arriving outside them are denied. The underlying design requirement is source endpoint conditions can restrict network origin in resource policies; endpoint policy alone cannot constrain all other routes.

B would delete the old KMS key immediately after changing its alias without checking encrypted EBS data. This is not a defensible answer to the stated constraint (A service encrypts EBS volumes with an old key but needs controlled rotation without downtime): key rotation and re-encryption are distinct tasks; disabling an in-use key breaks access to encrypted data. The required design is design a compatible KMS key rotation or replacement-and-copy procedure and test decryption grants; acceptance depends on evidence that current volumes remain readable and restored snapshots work under the intended key permissions.

C would rotate an alias to a new key and assume all existing ciphertext automatically re-encrypts. This is not a defensible answer to the stated constraint (A service encrypts EBS volumes with an old key but needs controlled rotation without downtime): key rotation and re-encryption are distinct tasks; disabling an in-use key breaks access to encrypted data. The required design is design a compatible KMS key rotation or replacement-and-copy procedure and test decryption grants; acceptance depends on evidence that current volumes remain readable and restored snapshots work under the intended key permissions.

D would copy snapshots under an inaccessible key policy and rely on the EC2 root role to decrypt them. This is not a defensible answer to the stated constraint (A service encrypts EBS volumes with an old key but needs controlled rotation without downtime): key rotation and re-encryption are distinct tasks; disabling an in-use key breaks access to encrypted data. The required design is design a compatible KMS key rotation or replacement-and-copy procedure and test decryption grants; acceptance depends on evidence that current volumes remain readable and restored snapshots work under the intended key permissions.

A reports an inadequate or failed acceptance condition: Existing encrypted volumes return KMS AccessDenied after the old key is disabled. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that current volumes remain readable and restored snapshots work under the intended key permissions. The underlying design requirement is key rotation and re-encryption are distinct tasks; disabling an in-use key breaks access to encrypted data.

C reports an inadequate or failed acceptance condition: An alias points to a new KMS key but old volume ciphertext still requires the former one. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that current volumes remain readable and restored snapshots work under the intended key permissions. The underlying design requirement is key rotation and re-encryption are distinct tasks; disabling an in-use key breaks access to encrypted data.

D reports an inadequate or failed acceptance condition: A snapshot is copied under a new key but the restore role lacks decrypt permissions. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that current volumes remain readable and restored snapshots work under the intended key permissions. The underlying design requirement is key rotation and re-encryption are distinct tasks; disabling an in-use key breaks access to encrypted data.

A would block all images with any informational scan result without documented policy and risk exceptions. This is not a defensible answer to the stated constraint (Production containers need verified image vulnerability findings before deployment): scanning plus enforcement can prevent known-risk images from entering production; scan results alone do not block rollout. The required design is integrate ECR image scanning and pipeline admission policy with documented risk exceptions; acceptance depends on evidence that a known vulnerable image is blocked while a compliant signed build passes the release gate.

B would scan only the Dockerfile text while never scanning the actual published image artifact. This is not a defensible answer to the stated constraint (Production containers need verified image vulnerability findings before deployment): scanning plus enforcement can prevent known-risk images from entering production; scan results alone do not block rollout. The required design is integrate ECR image scanning and pipeline admission policy with documented risk exceptions; acceptance depends on evidence that a known vulnerable image is blocked while a compliant signed build passes the release gate.

D would push every container image to production before ECR scan findings are evaluated. This is not a defensible answer to the stated constraint (Production containers need verified image vulnerability findings before deployment): scanning plus enforcement can prevent known-risk images from entering production; scan results alone do not block rollout. The required design is integrate ECR image scanning and pipeline admission policy with documented risk exceptions; acceptance depends on evidence that a known vulnerable image is blocked while a compliant signed build passes the release gate.

A reports an inadequate or failed acceptance condition: The scan report blocks a reviewed and excepted informational issue without risk policy reasoning. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a known vulnerable image is blocked while a compliant signed build passes the release gate. The underlying design requirement is scanning plus enforcement can prevent known-risk images from entering production; scan results alone do not block rollout.

B reports an inadequate or failed acceptance condition: A Dockerfile static scan succeeds, but the pushed image still has critical package vulnerabilities. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a known vulnerable image is blocked while a compliant signed build passes the release gate. The underlying design requirement is scanning plus enforcement can prevent known-risk images from entering production; scan results alone do not block rollout.

C reports an inadequate or failed acceptance condition: A known vulnerable ECR image passes the pipeline and reaches production workloads. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a known vulnerable image is blocked while a compliant signed build passes the release gate. The underlying design requirement is scanning plus enforcement can prevent known-risk images from entering production; scan results alone do not block rollout.