A reports an inadequate or failed acceptance condition: One central Region answers every user despite deployment availability in nearby Regions. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that users in test geographies reach closer healthy regional endpoints with reduced round-trip latency. The underlying design requirement is network path and region selection can dominate latency after compute is already sufficient.

B reports an inadequate or failed acceptance condition: Regional EC2 CPU falls while distant user RTT stays too high. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that users in test geographies reach closer healthy regional endpoints with reduced round-trip latency. The underlying design requirement is network path and region selection can dominate latency after compute is already sufficient.

C reports an inadequate or failed acceptance condition: A weighted DNS record chooses a distant endpoint for users who need low latency. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that users in test geographies reach closer healthy regional endpoints with reduced round-trip latency. The underlying design requirement is network path and region selection can dominate latency after compute is already sufficient.

B would increase web-tier AZ count but keep the database in the one existing AZ. This is not a defensible answer to the stated constraint (An existing EC2 application has a single-AZ database and a multi-AZ web layer): web-layer redundancy does not eliminate a single-AZ database failure domain. The required design is enable a suitable RDS Multi-AZ deployment and test database client reconnection; acceptance depends on evidence that after deliberate AZ failure, database writes resume through the endpoint without manual snapshot restoration.

C would use a read replica as an automatic Multi-AZ writer failover mechanism. This is not a defensible answer to the stated constraint (An existing EC2 application has a single-AZ database and a multi-AZ web layer): web-layer redundancy does not eliminate a single-AZ database failure domain. The required design is enable a suitable RDS Multi-AZ deployment and test database client reconnection; acceptance depends on evidence that after deliberate AZ failure, database writes resume through the endpoint without manual snapshot restoration.

D would treat the latest EBS snapshot as an always-running database standby with automatic reconnection. This is not a defensible answer to the stated constraint (An existing EC2 application has a single-AZ database and a multi-AZ web layer): web-layer redundancy does not eliminate a single-AZ database failure domain. The required design is enable a suitable RDS Multi-AZ deployment and test database client reconnection; acceptance depends on evidence that after deliberate AZ failure, database writes resume through the endpoint without manual snapshot restoration.

A reports an inadequate or failed acceptance condition: Application instances survive an AZ failure but the single-AZ database does not. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that after deliberate AZ failure, database writes resume through the endpoint without manual snapshot restoration. The underlying design requirement is web-layer redundancy does not eliminate a single-AZ database failure domain.

C reports an inadequate or failed acceptance condition: A read replica remains read-only and cannot automatically satisfy failed writer connections. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that after deliberate AZ failure, database writes resume through the endpoint without manual snapshot restoration. The underlying design requirement is web-layer redundancy does not eliminate a single-AZ database failure domain.

D reports an inadequate or failed acceptance condition: Restoring from an old EBS snapshot takes far longer than the stated failover objective. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that after deliberate AZ failure, database writes resume through the endpoint without manual snapshot restoration. The underlying design requirement is web-layer redundancy does not eliminate a single-AZ database failure domain.

A would use volatile in-memory deduplication that disappears during host replacement. This is not a defensible answer to the stated constraint (An SQS consumer sometimes handles the same event twice and creates duplicate financial ledger records): standard SQS at-least-once delivery can repeat messages; consumers must not rely on exactly-once receipt. The required design is use an idempotency key with conditional DynamoDB writes or equivalent transactional deduplication; acceptance depends on evidence that replaying the same event yields a single committed business operation.

B would perform a read-then-write check without an atomic conditional or transactional guard against races. This is not a defensible answer to the stated constraint (An SQS consumer sometimes handles the same event twice and creates duplicate financial ledger records): standard SQS at-least-once delivery can repeat messages; consumers must not rely on exactly-once receipt. The required design is use an idempotency key with conditional DynamoDB writes or equivalent transactional deduplication; acceptance depends on evidence that replaying the same event yields a single committed business operation.

D would process duplicate payment notifications unconditionally as separate ledger transactions. This is not a defensible answer to the stated constraint (An SQS consumer sometimes handles the same event twice and creates duplicate financial ledger records): standard SQS at-least-once delivery can repeat messages; consumers must not rely on exactly-once receipt. The required design is use an idempotency key with conditional DynamoDB writes or equivalent transactional deduplication; acceptance depends on evidence that replaying the same event yields a single committed business operation.

A reports an inadequate or failed acceptance condition: The duplicate check passes until the worker is replaced and memory resets. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that replaying the same event yields a single committed business operation. The underlying design requirement is standard SQS at-least-once delivery can repeat messages; consumers must not rely on exactly-once receipt.

B reports an inadequate or failed acceptance condition: Two concurrent replays both commit because the read-then-write sequence lacks atomic conditional protection. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that replaying the same event yields a single committed business operation. The underlying design requirement is standard SQS at-least-once delivery can repeat messages; consumers must not rely on exactly-once receipt.

C reports an inadequate or failed acceptance condition: Replaying a financial event generates a second ledger entry. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that replaying the same event yields a single committed business operation. The underlying design requirement is standard SQS at-least-once delivery can repeat messages; consumers must not rely on exactly-once receipt.

B would use an internet DNS alias and assume it keeps unhealthy single-AZ targets available. This is not a defensible answer to the stated constraint (An internet-facing service uses an ALB but all target instances live in one Availability Zone): an ALB being regional does not make single-AZ target placement highly available. The required design is spread healthy targets across multiple AZs and configure appropriately sized Auto Scaling capacity; acceptance depends on evidence that an AZ impairment leaves registered healthy targets serving clients.

C would deploy the ALB in two AZs while registering application targets only in one. This is not a defensible answer to the stated constraint (An internet-facing service uses an ALB but all target instances live in one Availability Zone): an ALB being regional does not make single-AZ target placement highly available. The required design is spread healthy targets across multiple AZs and configure appropriately sized Auto Scaling capacity; acceptance depends on evidence that an AZ impairment leaves registered healthy targets serving clients.

D would raise the number of hosts within the vulnerable AZ instead of distributing capacity. This is not a defensible answer to the stated constraint (An internet-facing service uses an ALB but all target instances live in one Availability Zone): an ALB being regional does not make single-AZ target placement highly available. The required design is spread healthy targets across multiple AZs and configure appropriately sized Auto Scaling capacity; acceptance depends on evidence that an AZ impairment leaves registered healthy targets serving clients.

A reports an inadequate or failed acceptance condition: The ALB endpoint resolves while no surviving target can complete a customer request. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an AZ impairment leaves registered healthy targets serving clients. The underlying design requirement is an ALB being regional does not make single-AZ target placement highly available.

C reports an inadequate or failed acceptance condition: The ALB lists two enabled AZs but shows healthy targets only in one. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an AZ impairment leaves registered healthy targets serving clients. The underlying design requirement is an ALB being regional does not make single-AZ target placement highly available.

D reports an inadequate or failed acceptance condition: The one-AZ Auto Scaling group launches replacements in the same failed failure domain. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an AZ impairment leaves registered healthy targets serving clients. The underlying design requirement is an ALB being regional does not make single-AZ target placement highly available.

A would hard-code the original Aurora writer instance endpoint after failover. This is not a defensible answer to the stated constraint (An API hard-codes an Aurora instance hostname and fails when a standby is promoted): direct instance endpoints bind clients to a node rather than the current cluster writer. The required design is switch write connections to the correct Aurora cluster endpoint and implement failover-aware reconnection; acceptance depends on evidence that application writes succeed after the promoted instance assumes the writer role.

B would send write SQL to Aurora reader endpoints and expect normal write transactions to work. This is not a defensible answer to the stated constraint (An API hard-codes an Aurora instance hostname and fails when a standby is promoted): direct instance endpoints bind clients to a node rather than the current cluster writer. The required design is switch write connections to the correct Aurora cluster endpoint and implement failover-aware reconnection; acceptance depends on evidence that application writes succeed after the promoted instance assumes the writer role.

D would use an Aurora cluster reader endpoint as the primary write endpoint without failover reconnection. This is not a defensible answer to the stated constraint (An API hard-codes an Aurora instance hostname and fails when a standby is promoted): direct instance endpoints bind clients to a node rather than the current cluster writer. The required design is switch write connections to the correct Aurora cluster endpoint and implement failover-aware reconnection; acceptance depends on evidence that application writes succeed after the promoted instance assumes the writer role.

A reports an inadequate or failed acceptance condition: The application continues querying the former Aurora instance address after promotion. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that application writes succeed after the promoted instance assumes the writer role. The underlying design requirement is direct instance endpoints bind clients to a node rather than the current cluster writer.

B reports an inadequate or failed acceptance condition: The promoted writer is healthy, but the client is still connected to a reader endpoint for writes. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that application writes succeed after the promoted instance assumes the writer role. The underlying design requirement is direct instance endpoints bind clients to a node rather than the current cluster writer.

C reports an inadequate or failed acceptance condition: A failover causes write requests to fail until engineers manually edit hard-coded hostnames. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that application writes succeed after the promoted instance assumes the writer role. The underlying design requirement is direct instance endpoints bind clients to a node rather than the current cluster writer.

B would write partial work to several services and assume a failed downstream operation rolls them all back automatically. This is not a defensible answer to the stated constraint (A distributed application loses half-complete transactions during retries of a multi-service operation): saga compensation coordinates distributed state transitions without pretending independent services share one ACID transaction. The required design is introduce durable workflow state and compensating steps through Step Functions or a saga pattern; acceptance depends on evidence that injected mid-workflow failure leaves a recorded state and completes a compensating action.

C would store the entire workflow only in Lambda memory, which cannot survive long delays and worker loss. This is not a defensible answer to the stated constraint (A distributed application loses half-complete transactions during retries of a multi-service operation): saga compensation coordinates distributed state transitions without pretending independent services share one ACID transaction. The required design is introduce durable workflow state and compensating steps through Step Functions or a saga pattern; acceptance depends on evidence that injected mid-workflow failure leaves a recorded state and completes a compensating action.

D would retry every saga step independently without durable workflow state or compensation. This is not a defensible answer to the stated constraint (A distributed application loses half-complete transactions during retries of a multi-service operation): saga compensation coordinates distributed state transitions without pretending independent services share one ACID transaction. The required design is introduce durable workflow state and compensating steps through Step Functions or a saga pattern; acceptance depends on evidence that injected mid-workflow failure leaves a recorded state and completes a compensating action.

A reports an inadequate or failed acceptance condition: A middle-step failure leaves every independent service reporting its own irreversible success. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that injected mid-workflow failure leaves a recorded state and completes a compensating action. The underlying design requirement is saga compensation coordinates distributed state transitions without pretending independent services share one ACID transaction.

C reports an inadequate or failed acceptance condition: The Lambda worker times out and all volatile saga state is lost before compensation. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that injected mid-workflow failure leaves a recorded state and completes a compensating action. The underlying design requirement is saga compensation coordinates distributed state transitions without pretending independent services share one ACID transaction.

D reports an inadequate or failed acceptance condition: A downstream service errors and upstream services retain noncompensated partial commits. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that injected mid-workflow failure leaves a recorded state and completes a compensating action. The underlying design requirement is saga compensation coordinates distributed state transitions without pretending independent services share one ACID transaction.