A reports an inadequate or failed acceptance condition: A middle-step failure leaves every independent service reporting its own irreversible success. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that injected mid-workflow failure leaves a recorded state and completes a compensating action. The underlying design requirement is saga compensation coordinates distributed state transitions without pretending independent services share one ACID transaction.

C reports an inadequate or failed acceptance condition: The Lambda worker times out and all volatile saga state is lost before compensation. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that injected mid-workflow failure leaves a recorded state and completes a compensating action. The underlying design requirement is saga compensation coordinates distributed state transitions without pretending independent services share one ACID transaction.

D reports an inadequate or failed acceptance condition: A downstream service errors and upstream services retain noncompensated partial commits. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that injected mid-workflow failure leaves a recorded state and completes a compensating action. The underlying design requirement is saga compensation coordinates distributed state transitions without pretending independent services share one ACID transaction.

A would copy only the current object bytes to a backup location without preserving historical versions. This is not a defensible answer to the stated constraint (An S3 data lake has versioning enabled but retention policies routinely expire older versions immediately): versioning does not protect recoverability if lifecycle rules rapidly delete all previous versions. The required design is set appropriate lifecycle and recovery retention for noncurrent versions and protected data; acceptance depends on evidence that accidental overwrite recovery retrieves a prior version within policy requirements.

B would delete noncurrent S3 object versions immediately after an overwrite despite recovery retention needs. This is not a defensible answer to the stated constraint (An S3 data lake has versioning enabled but retention policies routinely expire older versions immediately): versioning does not protect recoverability if lifecycle rules rapidly delete all previous versions. The required design is set appropriate lifecycle and recovery retention for noncurrent versions and protected data; acceptance depends on evidence that accidental overwrite recovery retrieves a prior version within policy requirements.

D would enable versioning but use lifecycle rules that remove all useful history before the stated recovery window. This is not a defensible answer to the stated constraint (An S3 data lake has versioning enabled but retention policies routinely expire older versions immediately): versioning does not protect recoverability if lifecycle rules rapidly delete all previous versions. The required design is set appropriate lifecycle and recovery retention for noncurrent versions and protected data; acceptance depends on evidence that accidental overwrite recovery retrieves a prior version within policy requirements.

A reports an inadequate or failed acceptance condition: The backup target contains the current object only, not the earlier version needed after accidental overwrite. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that accidental overwrite recovery retrieves a prior version within policy requirements. The underlying design requirement is versioning does not protect recoverability if lifecycle rules rapidly delete all previous versions.

B reports an inadequate or failed acceptance condition: The noncurrent version expires before the policy's required recovery window. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that accidental overwrite recovery retrieves a prior version within policy requirements. The underlying design requirement is versioning does not protect recoverability if lifecycle rules rapidly delete all previous versions.

C reports an inadequate or failed acceptance condition: Versioning is enabled, but a previously overwritten object can no longer be restored. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that accidental overwrite recovery retrieves a prior version within policy requirements. The underlying design requirement is versioning does not protect recoverability if lifecycle rules rapidly delete all previous versions.

B would wait indefinitely for the payments provider and exhaust all API request threads. This is not a defensible answer to the stated constraint (A message-processing fleet fails if an external payments provider stalls for more than 10 seconds): failure isolation prevents one slow dependency from exhausting unrelated service capacity. The required design is implement timeouts, bounded retries, circuit breaking and an asynchronous fallback queue; acceptance depends on evidence that during a provider fault, request threads stay available and queued work drains after recovery.

C would retry the unavailable provider without jitter or limits, amplifying the outage. This is not a defensible answer to the stated constraint (A message-processing fleet fails if an external payments provider stalls for more than 10 seconds): failure isolation prevents one slow dependency from exhausting unrelated service capacity. The required design is implement timeouts, bounded retries, circuit breaking and an asynchronous fallback queue; acceptance depends on evidence that during a provider fault, request threads stay available and queued work drains after recovery.

D would drop payment attempts immediately instead of queueing recoverable work during provider downtime. This is not a defensible answer to the stated constraint (A message-processing fleet fails if an external payments provider stalls for more than 10 seconds): failure isolation prevents one slow dependency from exhausting unrelated service capacity. The required design is implement timeouts, bounded retries, circuit breaking and an asynchronous fallback queue; acceptance depends on evidence that during a provider fault, request threads stay available and queued work drains after recovery.

A reports an inadequate or failed acceptance condition: Provider latency holds all request threads until they are exhausted. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that during a provider fault, request threads stay available and queued work drains after recovery. The underlying design requirement is failure isolation prevents one slow dependency from exhausting unrelated service capacity.

C reports an inadequate or failed acceptance condition: Unbounded retries increase queueing and worsen dependency overload. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that during a provider fault, request threads stay available and queued work drains after recovery. The underlying design requirement is failure isolation prevents one slow dependency from exhausting unrelated service capacity.

D reports an inadequate or failed acceptance condition: Requests are dropped while the external provider is unavailable rather than saved for replay. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that during a provider fault, request threads stay available and queued work drains after recovery. The underlying design requirement is failure isolation prevents one slow dependency from exhausting unrelated service capacity.

A would provide each subnet a separate route table but point all default routes to the failed-zone NAT. This is not a defensible answer to the stated constraint (A critical checkout application depends on only one NAT gateway located in an unrelated AZ): a NAT gateway is zonal; cross-AZ dependencies create avoidable availability risks. The required design is use per-AZ NAT gateways for internet-egress-dependent private subnets and zone-local routing; acceptance depends on evidence that aZ loss does not leave private instances in surviving zones dependent on the failed NAT.

B would remove every outbound internet route despite the declared internet-dependent workloads. This is not a defensible answer to the stated constraint (A critical checkout application depends on only one NAT gateway located in an unrelated AZ): a NAT gateway is zonal; cross-AZ dependencies create avoidable availability risks. The required design is use per-AZ NAT gateways for internet-egress-dependent private subnets and zone-local routing; acceptance depends on evidence that aZ loss does not leave private instances in surviving zones dependent on the failed NAT.

D would route all AZs' private egress through one NAT gateway in the AZ likely to fail. This is not a defensible answer to the stated constraint (A critical checkout application depends on only one NAT gateway located in an unrelated AZ): a NAT gateway is zonal; cross-AZ dependencies create avoidable availability risks. The required design is use per-AZ NAT gateways for internet-egress-dependent private subnets and zone-local routing; acceptance depends on evidence that aZ loss does not leave private instances in surviving zones dependent on the failed NAT.

A reports an inadequate or failed acceptance condition: Surviving AZ instances cannot reach approved external dependencies when their shared NAT fails. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that aZ loss does not leave private instances in surviving zones dependent on the failed NAT. The underlying design requirement is a NAT gateway is zonal; cross-AZ dependencies create avoidable availability risks.

B reports an inadequate or failed acceptance condition: A different route table exists but still points to the same unavailable NAT gateway. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that aZ loss does not leave private instances in surviving zones dependent on the failed NAT. The underlying design requirement is a NAT gateway is zonal; cross-AZ dependencies create avoidable availability risks.

C reports an inadequate or failed acceptance condition: All private subnet routes use the NAT gateway located in the failed AZ. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that aZ loss does not leave private instances in surviving zones dependent on the failed NAT. The underlying design requirement is a NAT gateway is zonal; cross-AZ dependencies create avoidable availability risks.

B would keep recovery points for less time than the formal EBS retention policy permits. This is not a defensible answer to the stated constraint (A workload needs recoverable EBS snapshots but snapshots are created manually without restore validation): an automated policy plus restore proof is more reliable than untested manual snapshots. The required design is automate AWS Backup EBS restore-point schedules and conduct recovery tests; acceptance depends on evidence that automated points meet retention and a test volume restores with expected filesystem data.

C would create snapshots only when operators remember and never test restoring them. This is not a defensible answer to the stated constraint (A workload needs recoverable EBS snapshots but snapshots are created manually without restore validation): an automated policy plus restore proof is more reliable than untested manual snapshots. The required design is automate AWS Backup EBS restore-point schedules and conduct recovery tests; acceptance depends on evidence that automated points meet retention and a test volume restores with expected filesystem data.

D would record backup job completion as sufficient without validating recoverable filesystem contents. This is not a defensible answer to the stated constraint (A workload needs recoverable EBS snapshots but snapshots are created manually without restore validation): an automated policy plus restore proof is more reliable than untested manual snapshots. The required design is automate AWS Backup EBS restore-point schedules and conduct recovery tests; acceptance depends on evidence that automated points meet retention and a test volume restores with expected filesystem data.

A reports an inadequate or failed acceptance condition: An old recovery point exists while the current retention policy has no maintained schedule. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that automated points meet retention and a test volume restores with expected filesystem data. The underlying design requirement is an automated policy plus restore proof is more reliable than untested manual snapshots.

C reports an inadequate or failed acceptance condition: A snapshot run completes sporadically but gaps exceed the required retention/RPO. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that automated points meet retention and a test volume restores with expected filesystem data. The underlying design requirement is an automated policy plus restore proof is more reliable than untested manual snapshots.

D reports an inadequate or failed acceptance condition: Automated backup jobs report success but restored volumes are unusable or incomplete. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that automated points meet retention and a test volume restores with expected filesystem data. The underlying design requirement is an automated policy plus restore proof is more reliable than untested manual snapshots.

A would keep authenticated sessions only in per-node memory and continue rotating hosts frequently. This is not a defensible answer to the stated constraint (A multi-tenant web app depends on a memory-only session cache that disappears whenever the node restarts): sticky routing cannot guarantee session continuity when the selected host or memory state disappears. The required design is externalize durable session state or design stateless signed sessions and test rolling restarts; acceptance depends on evidence that clients remain authenticated during instance replacement without a sticky host assignment.

B would use sticky sessions alone and assume a restarted node retains its old process memory. This is not a defensible answer to the stated constraint (A multi-tenant web app depends on a memory-only session cache that disappears whenever the node restarts): sticky routing cannot guarantee session continuity when the selected host or memory state disappears. The required design is externalize durable session state or design stateless signed sessions and test rolling restarts; acceptance depends on evidence that clients remain authenticated during instance replacement without a sticky host assignment.

D would copy the session cookie unchanged while losing the corresponding server-side state. This is not a defensible answer to the stated constraint (A multi-tenant web app depends on a memory-only session cache that disappears whenever the node restarts): sticky routing cannot guarantee session continuity when the selected host or memory state disappears. The required design is externalize durable session state or design stateless signed sessions and test rolling restarts; acceptance depends on evidence that clients remain authenticated during instance replacement without a sticky host assignment.

A reports an inadequate or failed acceptance condition: The user logs out on every instance replacement because session data lived only in RAM. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that clients remain authenticated during instance replacement without a sticky host assignment. The underlying design requirement is sticky routing cannot guarantee session continuity when the selected host or memory state disappears.

B reports an inadequate or failed acceptance condition: ALB stickiness remains configured but does not recover state after a failed host. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that clients remain authenticated during instance replacement without a sticky host assignment. The underlying design requirement is sticky routing cannot guarantee session continuity when the selected host or memory state disappears.

C reports an inadequate or failed acceptance condition: Clients retain cookies but servers no longer possess the corresponding authenticated sessions. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that clients remain authenticated during instance replacement without a sticky host assignment. The underlying design requirement is sticky routing cannot guarantee session continuity when the selected host or memory state disappears.