A reports an inadequate or failed acceptance condition: Backup objects are only in the failed production Region. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a restore rehearsal recovers the prior day's dataset within the allowed multi-hour window. The underlying design requirement is backup-and-restore suits relaxed RTO/RPO targets without ongoing secondary compute capacity.

C reports an inadequate or failed acceptance condition: A manual recovery ticket opens, but no scheduled restore point or deployment procedure exists. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a restore rehearsal recovers the prior day's dataset within the allowed multi-hour window. The underlying design requirement is backup-and-restore suits relaxed RTO/RPO targets without ongoing secondary compute capacity.

D reports an inadequate or failed acceptance condition: An active-active standby generates full production bills despite the low-cost standby requirement. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that a restore rehearsal recovers the prior day's dataset within the allowed multi-hour window. The underlying design requirement is backup-and-restore suits relaxed RTO/RPO targets without ongoing secondary compute capacity.

A would replicate writable databases to both Regions without conflict resolution or consistency controls. This is not a defensible answer to the stated constraint (A critical retail platform requires very low regional recovery time with active traffic in two Regions): active-active reduces recovery startup time, but application-level data conflicts need deliberate handling. The required design is use an appropriately designed multi-Region active-active application with conflict-aware replicated data; acceptance depends on evidence that both Regions handle live traffic and a regional failure does not require booting standby servers.

B would keep a cold backup Region and expect instant recovery without starting its infrastructure. This is not a defensible answer to the stated constraint (A critical retail platform requires very low regional recovery time with active traffic in two Regions): active-active reduces recovery startup time, but application-level data conflicts need deliberate handling. The required design is use an appropriately designed multi-Region active-active application with conflict-aware replicated data; acceptance depends on evidence that both Regions handle live traffic and a regional failure does not require booting standby servers.

D would send all user traffic to one Region and keep the other Region unable to accept requests. This is not a defensible answer to the stated constraint (A critical retail platform requires very low regional recovery time with active traffic in two Regions): active-active reduces recovery startup time, but application-level data conflicts need deliberate handling. The required design is use an appropriately designed multi-Region active-active application with conflict-aware replicated data; acceptance depends on evidence that both Regions handle live traffic and a regional failure does not require booting standby servers.

A reports an inadequate or failed acceptance condition: Conflicting concurrent writes across two Regions produce inconsistent inventory totals. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that both Regions handle live traffic and a regional failure does not require booting standby servers. The underlying design requirement is active-active reduces recovery startup time, but application-level data conflicts need deliberate handling.

B reports an inadequate or failed acceptance condition: The standby Region cannot answer requests until servers and databases boot from backup. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that both Regions handle live traffic and a regional failure does not require booting standby servers. The underlying design requirement is active-active reduces recovery startup time, but application-level data conflicts need deliberate handling.

C reports an inadequate or failed acceptance condition: Global clients are routed to the first Region only, with no active service in the second. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that both Regions handle live traffic and a regional failure does not require booting standby servers. The underlying design requirement is active-active reduces recovery startup time, but application-level data conflicts need deliberate handling.

B would keep the complete application Auto Scaling group in one Availability Zone. This is not a defensible answer to the stated constraint (A stateless API fails whenever one AZ's Auto Scaling group hosts disappear): multi-AZ placement eliminates single-AZ dependency when state and capacity are also resilient. The required design is distribute the Auto Scaling group and load balancer across at least two independent AZs; acceptance depends on evidence that an AZ failure causes healthy instances in surviving AZs to continue serving requests.

C would configure a multi-AZ ALB but leave the only available target instances in the failing AZ. This is not a defensible answer to the stated constraint (A stateless API fails whenever one AZ's Auto Scaling group hosts disappear): multi-AZ placement eliminates single-AZ dependency when state and capacity are also resilient. The required design is distribute the Auto Scaling group and load balancer across at least two independent AZs; acceptance depends on evidence that an AZ failure causes healthy instances in surviving AZs to continue serving requests.

D would add more hosts to the current AZ instead of providing capacity across independent AZs. This is not a defensible answer to the stated constraint (A stateless API fails whenever one AZ's Auto Scaling group hosts disappear): multi-AZ placement eliminates single-AZ dependency when state and capacity are also resilient. The required design is distribute the Auto Scaling group and load balancer across at least two independent AZs; acceptance depends on evidence that an AZ failure causes healthy instances in surviving AZs to continue serving requests.

A reports an inadequate or failed acceptance condition: The ALB spans two AZs but every registered healthy target is in the failed AZ. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an AZ failure causes healthy instances in surviving AZs to continue serving requests. The underlying design requirement is multi-AZ placement eliminates single-AZ dependency when state and capacity are also resilient.

C reports an inadequate or failed acceptance condition: The original one-AZ group launches more instances only within its failing zone. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an AZ failure causes healthy instances in surviving AZs to continue serving requests. The underlying design requirement is multi-AZ placement eliminates single-AZ dependency when state and capacity are also resilient.

D reports an inadequate or failed acceptance condition: An ALB health probe is green before loss, but no healthy target remains after zone isolation. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that an AZ failure causes healthy instances in surviving AZs to continue serving requests. The underlying design requirement is multi-AZ placement eliminates single-AZ dependency when state and capacity are also resilient.

A would create a cross-account copy with no separately protected vault access policies or lock controls. This is not a defensible answer to the stated constraint (A backup policy must protect critical EBS volumes and RDS databases across accounts against account compromise): cross-account immutable backup controls reduce the blast radius of source-account privilege compromise. The required design is use AWS Backup policies with a protected cross-account backup vault and suitable vault-lock controls; acceptance depends on evidence that recovery points exist in the isolated vault and are restorable without the compromised source account.

B would assume EBS volume snapshots replace cross-account RDS and EBS backup governance. This is not a defensible answer to the stated constraint (A backup policy must protect critical EBS volumes and RDS databases across accounts against account compromise): cross-account immutable backup controls reduce the blast radius of source-account privilege compromise. The required design is use AWS Backup policies with a protected cross-account backup vault and suitable vault-lock controls; acceptance depends on evidence that recovery points exist in the isolated vault and are restorable without the compromised source account.

D would keep all AWS Backup recovery points in the same compromised workload account. This is not a defensible answer to the stated constraint (A backup policy must protect critical EBS volumes and RDS databases across accounts against account compromise): cross-account immutable backup controls reduce the blast radius of source-account privilege compromise. The required design is use AWS Backup policies with a protected cross-account backup vault and suitable vault-lock controls; acceptance depends on evidence that recovery points exist in the isolated vault and are restorable without the compromised source account.

A reports an inadequate or failed acceptance condition: The remote copy vault has an unrestricted delete policy that the same source role can use. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that recovery points exist in the isolated vault and are restorable without the compromised source account. The underlying design requirement is cross-account immutable backup controls reduce the blast radius of source-account privilege compromise.

B reports an inadequate or failed acceptance condition: EBS snapshots exist, but the regulated RDS database has no independently protected recovery points. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that recovery points exist in the isolated vault and are restorable without the compromised source account. The underlying design requirement is cross-account immutable backup controls reduce the blast radius of source-account privilege compromise.

C reports an inadequate or failed acceptance condition: All backup vaults and snapshots remain deletable by a compromised source administrator. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that recovery points exist in the isolated vault and are restorable without the compromised source account. The underlying design requirement is cross-account immutable backup controls reduce the blast radius of source-account privilege compromise.

B would provision standby EC2 instance types without replicating current data volumes or testing launches. This is not a defensible answer to the stated constraint (A data-center application requires recovery of supported servers on AWS with frequent block replication): elastic Disaster Recovery maintains low-RPO block replication for server recovery, unlike manual AMI snapshots. The required design is use AWS Elastic Disaster Recovery to replicate source disks and launch recovery instances during drills; acceptance depends on evidence that recovery launches produce bootable instances at measured RPO/RTO targets.

C would use periodic AMI captures in place of the required frequent block replication. This is not a defensible answer to the stated constraint (A data-center application requires recovery of supported servers on AWS with frequent block replication): elastic Disaster Recovery maintains low-RPO block replication for server recovery, unlike manual AMI snapshots. The required design is use AWS Elastic Disaster Recovery to replicate source disks and launch recovery instances during drills; acceptance depends on evidence that recovery launches produce bootable instances at measured RPO/RTO targets.

D would replicate only DNS configurations and expect the original servers' disks to recover in AWS. This is not a defensible answer to the stated constraint (A data-center application requires recovery of supported servers on AWS with frequent block replication): elastic Disaster Recovery maintains low-RPO block replication for server recovery, unlike manual AMI snapshots. The required design is use AWS Elastic Disaster Recovery to replicate source disks and launch recovery instances during drills; acceptance depends on evidence that recovery launches produce bootable instances at measured RPO/RTO targets.

A reports an inadequate or failed acceptance condition: The recovery server is powered on with empty volumes, not a recoverable source-system state. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that recovery launches produce bootable instances at measured RPO/RTO targets. The underlying design requirement is elastic Disaster Recovery maintains low-RPO block replication for server recovery, unlike manual AMI snapshots.

C reports an inadequate or failed acceptance condition: The most recent AMI is days old rather than meeting the frequent replication interval. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that recovery launches produce bootable instances at measured RPO/RTO targets. The underlying design requirement is elastic Disaster Recovery maintains low-RPO block replication for server recovery, unlike manual AMI snapshots.

D reports an inadequate or failed acceptance condition: The DR instance starts, but its replicated application disks are missing. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that recovery launches produce bootable instances at measured RPO/RTO targets. The underlying design requirement is elastic Disaster Recovery maintains low-RPO block replication for server recovery, unlike manual AMI snapshots.

A would enable same-Region S3 replication and call it protection against total Region loss. This is not a defensible answer to the stated constraint (An S3 dataset must survive an entire AWS Region loss while maintaining version-level recovery): s3 CRR places copies in another Region; versioning supports distinct recovered object versions. The required design is enable versioning and S3 cross-Region replication with appropriate IAM and KMS configuration; acceptance depends on evidence that versioned objects replicate to the destination Region and can be read during source outage.

B would copy only the current object keys without preserving required version histories. This is not a defensible answer to the stated constraint (An S3 dataset must survive an entire AWS Region loss while maintaining version-level recovery): s3 CRR places copies in another Region; versioning supports distinct recovered object versions. The required design is enable versioning and S3 cross-Region replication with appropriate IAM and KMS configuration; acceptance depends on evidence that versioned objects replicate to the destination Region and can be read during source outage.

D would set up a destination bucket but omit the source replication IAM/KMS permissions needed for encrypted objects. This is not a defensible answer to the stated constraint (An S3 dataset must survive an entire AWS Region loss while maintaining version-level recovery): s3 CRR places copies in another Region; versioning supports distinct recovered object versions. The required design is enable versioning and S3 cross-Region replication with appropriate IAM and KMS configuration; acceptance depends on evidence that versioned objects replicate to the destination Region and can be read during source outage.

A reports an inadequate or failed acceptance condition: The destination S3 copy remains in the same Region as the source. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that versioned objects replicate to the destination Region and can be read during source outage. The underlying design requirement is s3 CRR places copies in another Region; versioning supports distinct recovered object versions.

B reports an inadequate or failed acceptance condition: Current object keys exist in another Region but historical versions cannot be recovered. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that versioned objects replicate to the destination Region and can be read during source outage. The underlying design requirement is s3 CRR places copies in another Region; versioning supports distinct recovered object versions.

C reports an inadequate or failed acceptance condition: Encrypted source versions remain unreplicated due to destination key-policy errors. This result does not establish the specified outcome for the current architecture. The decisive test must demonstrate that versioned objects replicate to the destination Region and can be read during source outage. The underlying design requirement is s3 CRR places copies in another Region; versioning supports distinct recovered object versions.