Enabling cross-account access to an Amazon S3 bucket requires a "two-sided" permission configuration.

1. Resource-Based Policy (in Account A): The owner of the resource (the S3 bucket in Account A) must create a resource-based policy (a bucket policy) that explicitly grants access to the principal in the other account. Option C correctly grants permission to the root of Account B, effectively trusting Account B to delegate those permissions to its own IAM principals.

2. Identity-Based Policy (in Account B): The administrator of the principal's account (Account B) must attach an identity-based policy (an IAM policy) to the user (UserDataProcessor). This policy must explicitly allow the user to perform the intended actions on the resource in Account A. Option D correctly provides this permission.

Both policies are required for the access to succeed.

A. Cross-origin resource sharing (CORS) is a browser security mechanism for web applications and is not relevant for programmatic access by an IAM user.

B. While granting access directly to a user ARN is possible, the delegation model in option C (granting to the account) is a more scalable and common pattern.

E. This IAM policy grants access to a bucket within Account B (bucket-in-account-b), not the required bucket in the external Account A.

1. AWS Identity and Access Management User Guide: In the section on how policies are evaluated

it states: "For a cross-account request

the principal who makes the request must have permissions from an identity-based policy in their account and from the resource-based policy in the resource's account."

Source: AWS IAM User Guide

"Determining whether a request is allowed or denied within an account"

Policy evaluation logic.

2. Amazon S3 User Guide: The documentation provides a specific walkthrough for this scenario

called "Tutorial: Delegate access across AWS accounts using IAM roles". A more direct example is under "Bucket owner granting cross-account bucket permissions". It shows that the bucket policy in the source account must grant permissions to the destination account's root user

and an IAM policy in the destination account must grant permissions to the specific user or role.

Source: Amazon S3 User Guide

Identity and access management for Amazon S3

"Bucket owner granting cross-account bucket permissions". The guide explicitly shows a bucket policy with "Principal": {"AWS": "arn:aws:iam::AccountB-ID:root"} and a corresponding user policy allowing action on arn:aws:s3:::bucket-in-account-a/.

3. AWS Security Blog: The post "How to Use Bucket Policies and Apply Defense-in-Depth to Help Secure Your Amazon S3 Data" explains the delegation model: "You can write a bucket policy that grants another account access to your S3 bucket... The administrator of the trusted account must then grant their IAM users access to your bucket."

Source: AWS Security Blog

"How to Use Bucket Policies and Apply Defense-in-Depth to Help Secure Your Amazon S3 Data"

section "Granting cross-account access to your S3 bucket".

An insufficient capacity error when adding instances to a cluster placement group indicates that AWS cannot find contiguous underlying hardware to co-locate the new instance with the existing ones. A recommended troubleshooting strategy is to stop all instances within the placement group and then start them again. This action may migrate the entire group to a different set of underlying hardware that has sufficient capacity to accommodate both the existing and the new instances. This approach attempts to resolve the capacity issue without requiring architectural changes.

A. A spread placement group has a hard limit of seven running instances per Availability Zone, so setting a minimum of eight is not possible. This also changes the architecture's intent.

C. AWS does not provide a feature to merge two placement groups. This is not a valid operation.

D. Launching on Dedicated Hosts is a significant architectural and cost change. It is not the most direct or common first step to troubleshoot a transient capacity error.

1. Amazon EC2 User Guide for Linux Instances: Under the section "Troubleshoot placement groups

" the guide explicitly states: "If you receive a capacity error when launching an instance in a placement group that already has running instances

stop and start all of the instances in the placement group

and then try the launch again. Starting the instances may migrate them to hardware that has capacity for all the requested instances." (See section: Placement groups > Troubleshoot placement groups).

2. Amazon EC2 User Guide for Linux Instances: The section on "Spread placement groups" details the limitations: "A spread placement group can span multiple Availability Zones within the same Region

and you can have a maximum of seven running instances per Availability Zone per group." This confirms that option A is invalid. (See section: Placement groups > Spread placement groups).

3. AWS API Reference - CreatePlacementGroup: The documentation for creating and managing placement groups does not include any action or parameter for merging existing groups

confirming that option C is not a valid AWS feature. (See the CreatePlacementGroup and related EC2 API actions in the AWS Command Line Interface Reference or SDK documentation).

This solution is the most cost-effective and meets all technical requirements. AWS DataSync is the purpose-built service for transferring large amounts of data from on-premises storage, like NFS, to AWS. Deploying the DataSync agent as a VM in the existing on-premises Hyper-V environment is the correct architecture, as it allows direct access to the NFS server. DataSync natively supports bandwidth throttling and task scheduling, fulfilling the requirement to copy data during non-business hours. Amazon S3 Glacier Deep Archive is the lowest-cost storage option, and its standard retrieval time of 12 hours is well within the required one-week timeframe, making it the most cost-effective choice for long-term archival.

A. Deploying the DataSync agent on an EC2 instance is inefficient and costly. S3 Glacier Instant Retrieval is more expensive than necessary for a one-week retrieval requirement.

C. Deploying the agent on EC2 is inefficient. Writing to S3 Standard first and then transitioning incurs unnecessary S3 Standard storage costs and lifecycle transition fees.

D. AWS Storage Gateway's Tape Gateway is designed to replace physical tape libraries for backup applications, not for a direct file-based copy from an NFS share. This adds unnecessary complexity.

1. AWS DataSync User Guide

"Requirements for AWS DataSync agents": This document confirms that the DataSync agent can be deployed on a Microsoft Hyper-V hypervisor on-premises. It states

"You can deploy your agent on a VMware ESXi

Linux Kernel-based Virtual Machine (KVM)

or Microsoft Hyper-V hypervisor."

2. AWS DataSync User Guide

"Working with tasks": This section details the features for managing data transfer. It explicitly mentions

"You can control the amount of network bandwidth that a task uses..." and "You can also schedule your task to run periodically

" which directly addresses the bandwidth and scheduling requirements.

3. AWS DataSync User Guide

"Creating a location for Amazon S3": This guide specifies that when creating an S3 location as a destination

you can choose the S3 storage class directly. The supported classes include GLACIERDEEPARCHIVE

confirming that data can be written directly to this tier without intermediate steps.

4. Amazon S3 User Guide

"Amazon S3 storage classes": This official documentation compares the S3 storage classes. It describes S3 Glacier Deep Archive as "Amazon S3’s lowest-cost storage class" and notes its standard retrieval time is "within 12 hours

" which satisfies the "within 1 week" requirement at the lowest cost.

5. AWS Storage Gateway User Guide

"What is Tape Gateway?": This document clarifies the use case for Tape Gateway: "A tape gateway provides a virtual tape library (VTL)... You can back up your data to virtual tapes in the VTL by using your existing tape-based backup application." This shows it is not the appropriate tool for a file-based transfer from an NFS server.

Amazon Data Lifecycle Manager (DLM) is a managed service designed to automate the creation, retention, and deletion of Amazon EBS snapshots. A key feature of DLM is the ability to define policies that automatically copy snapshots to other AWS Regions for disaster recovery purposes. This approach directly meets the requirements of copying snapshots to two additional Regions while imposing the lowest possible operational overhead, as it is a fully managed, "set-and-forget" solution that does not require writing or maintaining custom code.

B. This is a viable but less optimal solution. It requires writing, deploying, and maintaining a custom AWS Lambda function, which results in higher operational overhead compared to using a managed service like DLM.

C. This option is technically incorrect. While AWS Backup can create and copy EBS snapshots, you cannot use Amazon S3 cross-Region replication (CRR) directly on EBS snapshots, as they are not stored in user-managed S3 buckets.

D. Amazon EC2 Image Builder is a service for creating and managing golden Amazon Machine Images (AMIs), not for backing up individual EBS volumes. Using it for this purpose is inefficient and misaligned with the stated requirement.

---

1. Amazon Data Lifecycle Manager User Guide: "With Amazon Data Lifecycle Manager

you can automate the creation

retention

and deletion of snapshots taken of your Amazon EBS volumes... You can also set up policies to create EBS-backed AMIs and to copy snapshots to other Regions for disaster recovery." (Source: AWS Documentation

Amazon Data Lifecycle Manager User Guide

"What is Amazon Data Lifecycle Manager?")

2. Amazon Data Lifecycle Manager User Guide

Cross-Region copy: "For disaster recovery purposes

you can create snapshot lifecycle policies that automatically copy snapshots to up to three AWS Regions." This section details the configuration steps

confirming it as a built-in

low-overhead feature. (Source: AWS Documentation

Amazon Data Lifecycle Manager User Guide

"Cross-Region copy")

3. Amazon EBS User Guide

Copy an Amazon EBS snapshot: "When you copy a snapshot

you create a new

identical snapshot in the destination of your choice... You can copy snapshots within the same AWS Region or from one Region to another." This describes the underlying API action (CopySnapshot) that services like DLM and AWS Backup use

and it makes no mention of S3 CRR. (Source: AWS Documentation

Amazon EBS User Guide

"Copy an Amazon EBS snapshot")

4. AWS Backup Developer Guide

Copying a backup: "You can copy backups to other AWS Regions... A copy can be created on-demand or automatically as part of a scheduled backup plan." This confirms AWS Backup's capability but does not validate the incorrect mechanism (S3 CRR) proposed in option C. (Source: AWS Documentation

AWS Backup Developer Guide

"Copying a backup")

The core issue is latency and scalability for serving large video files, leading to buffering and timeouts. The most effective solution is to use a Content Delivery Network (CDN) with an optimized origin store. Amazon S3 is designed for durable, scalable, and cost-effective storage of large static objects like videos. Amazon CloudFront, a CDN, caches this content at edge locations globally, significantly reducing latency for users and offloading requests from the origin infrastructure. Migrating videos from EFS to S3 and serving them via CloudFront directly addresses the video buffering problem in the most scalable and cost-efficient manner.

A. Reconfiguring EFS to Max I/O mode might increase throughput but does not solve the fundamental problem of network latency for geographically dispersed users. It is not a cost-effective solution for content delivery.

B. Using instance stores is not appropriate for persistent data like blog content. This approach is operationally complex, introduces a high risk of data loss, and does not solve the content delivery issue.

D. While placing CloudFront in front of the ALB is a valid pattern for caching, it keeps the videos on EFS. S3 is a more performant, scalable, and cost-effective origin for large static media files than EFS.

1. Amazon S3 Documentation: "Amazon S3 is an object storage service that offers industry-leading scalability

data availability

security

and performance... S3 is ideal for a variety of use cases

including... backup and restore

disaster recovery

archive

data lakes

big data analytics

hybrid cloud storage

and cloud-native application data."

Source: AWS Documentation

"What is Amazon S3?"

https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html

2. Amazon CloudFront Documentation: "Amazon CloudFront is a content delivery network (CDN) service... When a user requests content that you're serving with CloudFront

the user is routed to the edge location that provides the lowest latency (time delay)

so that content is delivered with the best possible performance."

Source: AWS Documentation

"What is Amazon CloudFront?"

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html

3. AWS Well-Architected Framework

Performance Efficiency Pillar: "Use a content delivery network (CDN) to reduce latency by serving requests from a location closer to your end users... For static content

you can use Amazon S3 as the origin for Amazon CloudFront."

Source: AWS Well-Architected Framework

Performance Efficiency Pillar Whitepaper

"PERF 7: How do you select the best performing architecture?"

https://docs.aws.amazon.com/wellarchitected/latest/performance-efficiency-pillar/select-the-best-performing-architecture.html (Section: Caching)

4. Amazon EFS Documentation: "Amazon EFS is designed to provide massively parallel shared access to thousands of Amazon EC2 instances... Use cases such as lift-and-shift enterprise applications

big data analytics

web serving and content management...". While EFS can be used for web serving

it is not optimized for global

low-latency delivery of large media files compared to the S3 + CloudFront pattern.

Source: AWS Documentation

"What is Amazon Elastic File System?"

https://docs.aws.amazon.com/efs/latest/ug/what-is-efs.html

The solution must address two distinct requirements: remediating existing unencrypted Amazon Elastic Block Store (Amazon EBS) volumes and implementing a forward-looking governance strategy for a multi-account environment.

Option C correctly outlines the standard, supported procedure for encrypting an existing unencrypted EBS volume. This involves creating a snapshot, using that snapshot to create a new, encrypted volume, and then replacing the original volume on the instance.

Option A establishes the required central governance and compliance framework. AWS Control Tower is designed to set up and govern a secure, multi-account AWS environment. Activating the "strongly recommended" guardrails includes a detective control (Detect whether encryption is enabled for EBS volumes attached to EC2 instances) that automatically detects unencrypted volumes, fulfilling the future detection and central management requirements.

B: It is not possible to encrypt an existing EBS volume "in place." The process requires creating a new, encrypted volume from a snapshot of the original.

D: The specific guardrail for detecting unencrypted EBS volumes is part of the "strongly recommended" guardrail set, not the "mandatory" set. This option would fail to meet the detection requirement.

E: While technically feasible for a single account, this approach does not provide the centralized governance and compliance management across multiple accounts that AWS Control Tower offers, which is a core requirement.

1. Encrypting an unencrypted volume: AWS Documentation

Amazon EC2 User Guide for Linux Instances

section "Encrypting an unencrypted volume". It states

"To encrypt an unencrypted volume

you must create a snapshot of the volume. Then

you can either restore the snapshot to a new

encrypted volume... or you can create an encrypted copy of the snapshot and restore it to a new

encrypted volume." This supports option C.

2. AWS Control Tower Guardrails: AWS Documentation

AWS Control Tower User Guide

section "Guardrail reference". The guide lists the guardrail Detect whether encryption is enabled for EBS volumes attached to EC2 instances (Identifier: AWS-GREBSVOLUMEENCRYPTIONMANDATORY) under the "Strongly recommended" behavior category. This supports option A and invalidates option D.

3. AWS Control Tower Overview: AWS Documentation

AWS Control Tower User Guide

section "What is AWS Control Tower?". It describes Control Tower as "the easiest way to set up and govern a secure

multi-account AWS environment

" which aligns with the requirement for a central management solution.

The optimal solution must address two key aspects: data locality and traffic routing. Given that over 90% of the database traffic is read-only, creating a cross-Region read replica for the Amazon RDS database is the most efficient and native AWS solution. This places a readable copy of the data in the new Europe Region, significantly reducing data access latency for European users. To complement this, Amazon Route 53 latency-based routing should be used. This policy directs users to the AWS Region that provides the lowest network latency for them, ensuring that both US and European users are automatically routed to their nearest and fastest application endpoint (API Gateway), thereby minimizing report download times.

A. An AWS DMS full load task is a one-time data migration. It does not provide continuous replication, so the database in the new Region would quickly become outdated.

B. While AWS DMS with Change Data Capture (CDC) provides replication, a native RDS cross-Region read replica is a simpler, more managed, and purpose-built solution for this use case.

D. Geolocation routing directs users based on their geographic origin, which is a reasonable proxy for latency. However, latency-based routing is more precise as it routes based on actual measured network performance to the AWS Regions.

1. Amazon RDS User Guide: "A cross-Region read replica is used to reduce latency for read queries. If you have a read-heavy workload and your users are globally distributed

you can create one or more read replicas in various AWS Regions to serve read traffic closer to your users."

Source: AWS Documentation

Amazon RDS User Guide

"Working with Amazon RDS read replicas

" Section: "Cross-Region read replicas."

2. Amazon Route 53 Developer Guide: "Latency-based routing lets you route your traffic to the AWS Region that provides the best latency (lowest network latency) and the best experience for your users. When Route 53 receives a query for your domain or subdomain

it determines which AWS Regions you've created latency records for

determines which region gives the user the lowest latency

and then selects a latency record for that region."

Source: AWS Documentation

Amazon Route 53 Developer Guide

"Choosing a routing policy

" Section: "Latency-based routing."

3. AWS Well-Architected Framework - Performance Efficiency Pillar: "To reduce latency

you can locate your resources closer to your users. You can do this by selecting the AWS Regions and edge locations that are closest to your users." This principle supports the use of both cross-Region resources (like the read replica) and latency-aware routing.

Source: AWS Well-Architected Framework

Performance Efficiency Pillar (aws-well-architected-framework.pdf)

Page 29

"Select the best performing architecture."

This solution correctly implements the standard AWS pattern for performing actions on an instance before it is terminated by an Auto Scaling group. An Auto Scaling lifecycle hook for the autoscaling:EC2INSTANCETERMINATING event pauses the termination process, placing the instance in a Terminating:Wait state. An Amazon EventBridge rule detects this state change and triggers an AWS Lambda function. The Lambda function uses the AWS Systems Manager (SSM) SendCommand API to reliably execute a predefined script (an SSM document) on the instance to copy the logs. Once the command is sent, the Lambda function signals the lifecycle hook to CONTINUE, allowing the Auto Scaling group to proceed with the termination.

A. This option incorrectly uses the ABANDON signal, which would cancel the termination action, preventing the instance from being scaled in as intended by the Auto Scaling group.

C. Reducing the log delivery frequency only lessens the chance of data loss but does not guarantee it. Furthermore, user data scripts run only at instance launch and cannot be re-invoked to handle termination events.

D. This option incorrectly uses the ABANDON signal. This would cancel the scale-in event, leaving the instance running and disrupting the Auto Scaling group's desired capacity.

1. AWS Auto Scaling Documentation - Amazon EC2 Auto Scaling lifecycle hooks: This document explains how lifecycle hooks work

including the EC2INSTANCETERMINATING state. It explicitly mentions the pattern of using EventBridge

Lambda

and SSM Run Command to perform actions before termination. See the section "Tutorial: Configure a lifecycle hook that invokes a Lambda function".

Source: AWS Documentation

Amazon EC2 Auto Scaling User Guide

"Amazon EC2 Auto Scaling lifecycle hooks".

2. AWS Auto Scaling Documentation - CompleteLifecycleAction: This API reference details the CONTINUE and ABANDON results. It clarifies that CONTINUE signals that the lifecycle action is complete and the Auto Scaling group can proceed

while ABANDON cancels the action.

Source: AWS Documentation

Amazon EC2 Auto Scaling API Reference

"CompleteLifecycleAction".

3. AWS Systems Manager Documentation - AWS Systems Manager Run Command: This document describes how Run Command allows you to remotely and securely manage the configuration of your managed instances. It is the recommended method for running scripts on instances in response to events.

Source: AWS Documentation

AWS Systems Manager User Guide

"AWS Systems Manager Run Command".

4. AWS Compute Blog - Using lifecycle hooks to drain tasks from a container instance: While this example is for ECS

it demonstrates the same architectural pattern: Lifecycle Hook -> EventBridge -> Lambda. The blog states

"The Lambda function is responsible for performing the custom action and then sending the CONTINUE signal back to the Auto Scaling group." This confirms the correct use of the CONTINUE signal.

Source: AWS Compute Blog

"Using lifecycle hooks to drain tasks from a container instance

" Paragraph 5 under "The solution".

This solution represents a warm standby approach, which is optimal for minimizing recovery time (RTO) as required. By pre-provisioning the Amazon ECS cluster and service in the disaster recovery (DR) Region, the application compute layer is ready to accept traffic. Using a cross-Region read replica for the Amazon RDS database ensures that data is continuously and asynchronously replicated. During a failover, the process is swift: the Lambda function promotes the read replica to a standalone, writable primary instance and updates the Amazon Route 53 DNS record. This promotion process is significantly faster than creating a new database instance from a snapshot, directly meeting the requirement to minimize recovery time.

A. Restoring an RDS instance from a snapshot is a time-consuming process that results in a higher Recovery Time Objective (RTO) compared to promoting a read replica.

B. This option is even slower than A because it creates the ECS infrastructure during the failover event, in addition to the slow RDS snapshot restore process.

D. Converting a relational RDS snapshot to a DynamoDB global table during a disaster is technically complex, slow, and would likely require significant application code changes.

1. AWS Documentation

Amazon RDS User Guide: "You can use read replicas for disaster recovery... To use a read replica for disaster recovery

you promote the read replica. When you promote a read replica

it becomes a standalone DB instance." This guide details the process for "Promoting a read replica to be a standalone DB instance."

2. AWS Whitepaper

Disaster Recovery (DR) Architecture on AWS

Part III: Pilot Light and Warm Standby: This paper describes the Warm Standby approach. "In the case of disaster

the warm standby site can be scaled up to handle the full production load... For databases

you can use native features such as SQL Server Always On

Oracle Data Guard

or MySQL/PostgreSQL replication to a warm standby." (Page 5). This aligns with using an RDS read replica.

3. AWS Well-Architected Framework

Reliability Pillar: "Use a warm standby in a different AWS Region. This approach decreases the recovery time because your data is live in the other Region and the core infrastructure is running." This directly supports the chosen architecture of having running infrastructure (ECS) and a replicated database (RDS Read Replica). (Section: "Plan for disaster recovery (DR)").

This solution correctly addresses all three requirements outlined in the scenario. First, using AWS Lambda provisioned concurrency directly mitigates the cold start issue by keeping functions initialized and ready to respond instantly, ensuring low latency during traffic peaks. Second, for the database with consistent usage over 12 months, purchasing RDS Reserved Instances is the most cost-effective strategy, offering significant savings over On-Demand pricing. Third, integrating AWS WAF with Amazon CloudFront is the standard and most effective method to protect against common web exploits like SQL injection by filtering malicious traffic at the edge before it reaches the application.

A. Increasing a Lambda timeout does not solve cold starts. AWS Shield Advanced is primarily for DDoS protection, not for blocking application-layer attacks like SQL injection.

B. Amazon Redshift is a data warehouse, not a transactional (OLTP) database suitable for an ecommerce application. Amazon Inspector is a vulnerability scanner, not a web application firewall.

C. While provisioned concurrency is correct, AWS Shield Advanced is the wrong service for SQL injection protection. Also, for a consistent workload, RDS Reserved Instances are more cost-effective than Aurora Serverless.

---

References:

1. AWS Lambda Provisioned Concurrency:

AWS Lambda Documentation, "Configuring provisioned concurrency": "Provisioned concurrency initializes a requested number of execution environments so that they are prepared to respond immediately to your function's invocations... a great way to ensure that your serverless application is highly responsive and can scale to meet expected demand without any cold starts."

Source: AWS Lambda Developer Guide, Section: "Managing concurrency for a Lambda function".

2. RDS Reserved Instances:

Amazon RDS Documentation, "Reserved DB instances for Amazon RDS": "Reserved DB instances give you the option to reserve a DB instance for a one- or three-year term and in turn receive a significant discount compared to the On-Demand DB instance pricing... We recommend Reserved DB instances for applications with steady-state usage."

Source: Amazon RDS User Guide, Section: "Billing for DB instances".

3. AWS WAF for SQL Injection:

AWS WAF Documentation, "How AWS WAF works": "AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to your protected web application resources... You can configure conditions to look for, such as... the values in request headers, or strings that appear in requests that are likely to be malicious (such as SQL injection)."

Source: AWS WAF, AWS Firewall Manager, and AWS Shield Advanced Developer Guide, Section: "How AWS WAF works".

4. AWS Shield Advanced vs. AWS WAF:

AWS Shield Documentation, "AWS Shield Advanced": "For higher levels of protection against attacks, you can subscribe to AWS Shield Advanced... Shield Advanced provides expanded DDoS attack protection for your AWS resources." This confirms its primary purpose is DDoS mitigation, whereas WAF handles application-layer threats.

Source: AWS WAF, AWS Firewall Manager, and AWS Shield Advanced Developer Guide, Section: "AWS Shield Advanced".