A reports an inadequate or failed acceptance condition: An S3 endpoint route is configured while the financial database API still requires public egress. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that the API hostname resolves privately and connections work with internet egress blocked. The underlying design requirement is privateLink interface endpoints expose AWS APIs through private ENIs, not a NAT gateway.

B reports an inadequate or failed acceptance condition: API calls succeed through a NAT gateway and public AWS endpoints. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that the API hostname resolves privately and connections work with internet egress blocked. The underlying design requirement is privateLink interface endpoints expose AWS APIs through private ENIs, not a NAT gateway.

C reports an inadequate or failed acceptance condition: The interface endpoint is Available but HTTPS requests are rejected by its security group. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that the API hostname resolves privately and connections work with internet egress blocked. The underlying design requirement is privateLink interface endpoints expose AWS APIs through private ENIs, not a NAT gateway.

B would collect resource inventory in Cost Explorer rather than evaluating Config rule compliance. This is not a defensible answer to the stated constraint (Security operations wants account-wide resource compliance findings with centrally governed remediation): aWS Config provides configuration compliance history; CloudTrail captures who invoked API actions. The required design is aggregate AWS Config rules through an organization-level configuration setup and automation; acceptance depends on evidence that noncompliant resources appear in the aggregator and remediation events are traceable.

C would deploy Config only in a single member account and call it organization-wide governance. This is not a defensible answer to the stated constraint (Security operations wants account-wide resource compliance findings with centrally governed remediation): aWS Config provides configuration compliance history; CloudTrail captures who invoked API actions. The required design is aggregate AWS Config rules through an organization-level configuration setup and automation; acceptance depends on evidence that noncompliant resources appear in the aggregator and remediation events are traceable.

D would configure remediation automation without recording affected resource configuration or rule evaluations. This is not a defensible answer to the stated constraint (Security operations wants account-wide resource compliance findings with centrally governed remediation): aWS Config provides configuration compliance history; CloudTrail captures who invoked API actions. The required design is aggregate AWS Config rules through an organization-level configuration setup and automation; acceptance depends on evidence that noncompliant resources appear in the aggregator and remediation events are traceable.

A reports an inadequate or failed acceptance condition: Cost Explorer lists all resources but no Config noncompliance evaluations. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that noncompliant resources appear in the aggregator and remediation events are traceable. The underlying design requirement is aWS Config provides configuration compliance history; CloudTrail captures who invoked API actions.

C reports an inadequate or failed acceptance condition: The lone account's Config rules pass while newly added member accounts remain untracked. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that noncompliant resources appear in the aggregator and remediation events are traceable. The underlying design requirement is aWS Config provides configuration compliance history; CloudTrail captures who invoked API actions.

D reports an inadequate or failed acceptance condition: An automation document is configured but no evaluated resource or remediation run is recorded. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that noncompliant resources appear in the aggregator and remediation events are traceable. The underlying design requirement is aWS Config provides configuration compliance history; CloudTrail captures who invoked API actions.

A would use Object Lock governance mode and assume even authorized users can never bypass retention. This is not a defensible answer to the stated constraint (An audit requires proving object changes could not be silently replaced or deleted for a retention period): object Lock compliance mode enforces WORM retention that privileged users cannot bypass. The required design is use S3 Object Lock in compliance mode with a defined retention period on a versioned bucket; acceptance depends on evidence that attempts to shorten retention or remove protected object versions fail within the retention window.

B would set a bucket lifecycle expiration that should delete protected object versions before retention ends. This is not a defensible answer to the stated constraint (An audit requires proving object changes could not be silently replaced or deleted for a retention period): object Lock compliance mode enforces WORM retention that privileged users cannot bypass. The required design is use S3 Object Lock in compliance mode with a defined retention period on a versioned bucket; acceptance depends on evidence that attempts to shorten retention or remove protected object versions fail within the retention window.

D would rely on S3 Versioning alone with no Object Lock retention enforcement. This is not a defensible answer to the stated constraint (An audit requires proving object changes could not be silently replaced or deleted for a retention period): object Lock compliance mode enforces WORM retention that privileged users cannot bypass. The required design is use S3 Object Lock in compliance mode with a defined retention period on a versioned bucket; acceptance depends on evidence that attempts to shorten retention or remove protected object versions fail within the retention window.

A reports an inadequate or failed acceptance condition: A governance-mode version can be removed with the authorized bypass-retention permission. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that attempts to shorten retention or remove protected object versions fail within the retention window. The underlying design requirement is object Lock compliance mode enforces WORM retention that privileged users cannot bypass.

B reports an inadequate or failed acceptance condition: A protected object's current key disappears under a delete marker, while version-retention behavior is not checked. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that attempts to shorten retention or remove protected object versions fail within the retention window. The underlying design requirement is object Lock compliance mode enforces WORM retention that privileged users cannot bypass.

C reports an inadequate or failed acceptance condition: Bucket versioning creates older versions that privileged users can permanently delete. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that attempts to shorten retention or remove protected object versions fail within the retention window. The underlying design requirement is object Lock compliance mode enforces WORM retention that privileged users cannot bypass.

B would deploy Multi-AZ only for stateless application servers, leaving the RDS database single-AZ. This is not a defensible answer to the stated constraint (An order database needs an automatic Availability Zone failover with minimal downtime but no cross-Region requirement): rDS Multi-AZ is designed for HA; read replicas primarily offload reads and can lag. The required design is choose Amazon RDS Multi-AZ deployment and exercise failover rather than relying on a read replica; acceptance depends on evidence that the standby is promoted automatically and the database endpoint becomes reachable after failover.

C would use an asynchronous read replica in the same Region and assume automatic HA failover. This is not a defensible answer to the stated constraint (An order database needs an automatic Availability Zone failover with minimal downtime but no cross-Region requirement): rDS Multi-AZ is designed for HA; read replicas primarily offload reads and can lag. The required design is choose Amazon RDS Multi-AZ deployment and exercise failover rather than relying on a read replica; acceptance depends on evidence that the standby is promoted automatically and the database endpoint becomes reachable after failover.

D would rely on EBS snapshots and manually restore the database whenever its AZ fails. This is not a defensible answer to the stated constraint (An order database needs an automatic Availability Zone failover with minimal downtime but no cross-Region requirement): rDS Multi-AZ is designed for HA; read replicas primarily offload reads and can lag. The required design is choose Amazon RDS Multi-AZ deployment and exercise failover rather than relying on a read replica; acceptance depends on evidence that the standby is promoted automatically and the database endpoint becomes reachable after failover.

A reports an inadequate or failed acceptance condition: The application tier survives an AZ failure, but the primary single-AZ RDS database stays unavailable. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that the standby is promoted automatically and the database endpoint becomes reachable after failover. The underlying design requirement is rDS Multi-AZ is designed for HA; read replicas primarily offload reads and can lag.

C reports an inadequate or failed acceptance condition: A read replica serves SELECT queries but does not automatically become the Multi-AZ standby. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that the standby is promoted automatically and the database endpoint becomes reachable after failover. The underlying design requirement is rDS Multi-AZ is designed for HA; read replicas primarily offload reads and can lag.

D reports an inadequate or failed acceptance condition: A snapshot can restore a database hours later rather than fail over automatically. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that the standby is promoted automatically and the database endpoint becomes reachable after failover. The underlying design requirement is rDS Multi-AZ is designed for HA; read replicas primarily offload reads and can lag.

A would keep only daily cross-Region backups and start restore after the outage despite a 15-minute RPO. This is not a defensible answer to the stated constraint (A regional outage must not exceed a 15-minute data-loss window and the app must resume within an hour): warm standby keeps a scaled-down working application, unlike a cold backup-only recovery. The required design is deploy warm standby in a second Region with cross-Region data replication and rehearsed traffic cutover; acceptance depends on evidence that dR drills meet measured RPO and RTO during primary-Region isolation.

B would maintain a completely cold secondary Region that requires hours to create networking and compute. This is not a defensible answer to the stated constraint (A regional outage must not exceed a 15-minute data-loss window and the app must resume within an hour): warm standby keeps a scaled-down working application, unlike a cold backup-only recovery. The required design is deploy warm standby in a second Region with cross-Region data replication and rehearsed traffic cutover; acceptance depends on evidence that dR drills meet measured RPO and RTO during primary-Region isolation.

D would replicate data asynchronously without measuring lag and claim the 15-minute RPO is guaranteed. This is not a defensible answer to the stated constraint (A regional outage must not exceed a 15-minute data-loss window and the app must resume within an hour): warm standby keeps a scaled-down working application, unlike a cold backup-only recovery. The required design is deploy warm standby in a second Region with cross-Region data replication and rehearsed traffic cutover; acceptance depends on evidence that dR drills meet measured RPO and RTO during primary-Region isolation.

A reports an inadequate or failed acceptance condition: The last daily backup has an age exceeding the 15-minute RPO. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that dR drills meet measured RPO and RTO during primary-Region isolation. The underlying design requirement is warm standby keeps a scaled-down working application, unlike a cold backup-only recovery.

B reports an inadequate or failed acceptance condition: Secondary-region networking must still be built before any instance can serve traffic. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that dR drills meet measured RPO and RTO during primary-Region isolation. The underlying design requirement is warm standby keeps a scaled-down working application, unlike a cold backup-only recovery.

C reports an inadequate or failed acceptance condition: A replication job shows Running, but measured replication lag exceeds 15 minutes during failure. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that dR drills meet measured RPO and RTO during primary-Region isolation. The underlying design requirement is warm standby keeps a scaled-down working application, unlike a cold backup-only recovery.

B would keep the sole backup copy in the same Region as the production service. This is not a defensible answer to the stated constraint (A service accepts a daily recovery point and a many-hour recovery time and minimizes standby spend): backup-and-restore suits relaxed RTO/RPO targets without ongoing secondary compute capacity. The required design is use automated cross-Region backups with a documented restore-and-redeploy procedure; acceptance depends on evidence that a restore rehearsal recovers the prior day's dataset within the allowed multi-hour window.

C would rely on unmanaged manual snapshots with no scheduled cross-Region copy or restore runbook. This is not a defensible answer to the stated constraint (A service accepts a daily recovery point and a many-hour recovery time and minimizes standby spend): backup-and-restore suits relaxed RTO/RPO targets without ongoing secondary compute capacity. The required design is use automated cross-Region backups with a documented restore-and-redeploy procedure; acceptance depends on evidence that a restore rehearsal recovers the prior day's dataset within the allowed multi-hour window.

D would pay for full active-active production capacity in two Regions despite multi-hour permitted recovery. This is not a defensible answer to the stated constraint (A service accepts a daily recovery point and a many-hour recovery time and minimizes standby spend): backup-and-restore suits relaxed RTO/RPO targets without ongoing secondary compute capacity. The required design is use automated cross-Region backups with a documented restore-and-redeploy procedure; acceptance depends on evidence that a restore rehearsal recovers the prior day's dataset within the allowed multi-hour window.

A reports an inadequate or failed acceptance condition: Backup objects are only in the failed production Region. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a restore rehearsal recovers the prior day's dataset within the allowed multi-hour window. The underlying design requirement is backup-and-restore suits relaxed RTO/RPO targets without ongoing secondary compute capacity.

C reports an inadequate or failed acceptance condition: A manual recovery ticket opens, but no scheduled restore point or deployment procedure exists. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a restore rehearsal recovers the prior day's dataset within the allowed multi-hour window. The underlying design requirement is backup-and-restore suits relaxed RTO/RPO targets without ongoing secondary compute capacity.

D reports an inadequate or failed acceptance condition: An active-active standby generates full production bills despite the low-cost standby requirement. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a restore rehearsal recovers the prior day's dataset within the allowed multi-hour window. The underlying design requirement is backup-and-restore suits relaxed RTO/RPO targets without ongoing secondary compute capacity.