This solution provides an event-driven architecture with minimal operational overhead, directly addressing the question's requirements. Using Amazon S3 event notifications to trigger an Amazon EventBridge rule is an efficient replacement for the polling mechanism. EventBridge can then directly invoke an Amazon ECS task. Choosing the AWS Fargate launch type for ECS makes the compute layer serverless, eliminating the need to manage underlying EC2 instances. Fargate tasks can run for much longer than the required 25 minutes, making it a suitable choice for the long-running processing job. This combination optimizes the workflow and significantly reduces operational burdens.

B: AWS Lambda functions have a maximum execution timeout of 15 minutes. This is insufficient for the processing job that can take up to 25 minutes, causing it to fail.

C: An AWS Glue crawler is designed to discover data schemas and populate the AWS Glue Data Catalog, not to act as a real-time application trigger. This is an incorrect use of the service.

D: This option is incorrect for the same reason as option B. Deploying the container to AWS Lambda is not viable due to the 15-minute execution timeout limit, which is less than the 25-minute processing time.

1. AWS Lambda Quotas: The official AWS Lambda documentation states the maximum execution duration for a function.

Source: AWS Lambda Developer Guide

"Lambda quotas".

Reference: In the "Function configuration

deployment

and execution quotas" table

the "Timeout" resource has a maximum value of 900 seconds (15 minutes).

2. Invoking ECS Tasks from S3 Events: The AWS documentation outlines the event-driven pattern of using S3 events with EventBridge to start an ECS task

which is ideal for this scenario.

Source: AWS Compute Blog

"Introducing Amazon EventBridge integration for Amazon ECS".

Reference: The blog post details how "Amazon ECS is now a target for Amazon EventBridge

" allowing you to "run Amazon ECS tasks on a schedule

or in response to any EventBridge event." This includes S3 object creation events.

3. AWS Fargate for Long-Running Tasks: Fargate is a serverless compute engine suitable for containerized applications

including batch jobs that run longer than the Lambda timeout.

Source: AWS Fargate FAQs.

Reference: The FAQ page clarifies that Fargate is suitable for "batch workloads... that run for a short period of time

" which can be minutes or hours

thus easily accommodating the 25-minute requirement without the operational overhead of managing servers.

4. Purpose of AWS Glue Crawlers: The AWS Glue documentation specifies the intended use of crawlers

which does not align with triggering application logic.

Source: AWS Glue Developer Guide

"Defining Crawlers".

Reference: The guide states

"You use a crawler to populate the AWS Glue Data Catalog with tables. This is the primary method used by most AWS Glue users." This confirms its purpose is metadata discovery

not event-based invocation.

The most secure and operationally efficient method for providing cross-account access to AWS resources is by using an IAM role. This solution creates an IAM role in the resource-owning account (Sales) with policies that grant read access to the specific S3 bucket and decrypt permissions for the associated KMS key. The role's trust policy is configured to allow the QuickSight service role from the Marketing account to assume it. This approach provides temporary, auditable credentials to QuickSight without duplicating petabytes of data, thereby minimizing both cost and operational overhead, which directly aligns with the stated requirements.

A. Replicating petabytes of data is extremely expensive (storage, transfer, and replication costs) and introduces significant operational overhead and data latency, violating the core requirement.

B. Service Control Policies (SCPs) are used to set permission guardrails (deny actions) at an organizational level; they cannot be used to grant permissions.

C. The S3 bucket policy must be attached to the bucket in the resource-owning account (Sales), not the consumer account (Marketing), making this option's instruction incorrect.

1. AWS QuickSight User Guide

"Accessing S3 buckets in another AWS account": This document explicitly states the required pattern: "To connect to an S3 bucket in another account

you must create an IAM role in that account that provides access to Amazon QuickSight. You also need to grant Amazon QuickSight permissions to assume that role." This directly validates the approach in option D.

2. AWS IAM User Guide

"IAM tutorial: Delegate access across AWS accounts using IAM roles": This tutorial details the standard

recommended architecture for cross-account access. It describes creating a role in the resource-owning account (Account A

or Sales in this scenario) and establishing a trust policy that allows a principal in another account (Account B

or Marketing) to assume that role.

3. AWS Key Management Service Developer Guide

"Allowing users in other accounts to use a KMS key": Section "How to allow users in other accounts to use a KMS key" explains that to use a KMS key across accounts

you must use both an IAM policy and the key policy. The IAM role created in the Sales account would be granted kms:Decrypt permissions in its policy

and the KMS key's own policy must allow the role to be used. This is an integral part of the solution described in option D.

4. AWS Organizations User Guide

"Service control policies (SCPs)": This guide clarifies the function of SCPs

stating

"SCPs don't grant permissions. Instead

SCPs are JSON policies that specify the maximum permissions for the affected accounts." This confirms that SCPs cannot be used to grant access as suggested in option B.

The most effective and efficient way to prevent a specific API action across all accounts within an Organizational Unit (OU) is by using a Service Control Policy (SCP). An SCP with a Deny effect for the ec2:AuthorizeSecurityGroupIngress action provides a preventative guardrail. When this SCP is attached to the NonProd OU, it is inherited by all member accounts, ensuring that no IAM principal in those accounts can create a security group rule with the specified source, regardless of their individual IAM permissions. This centralized enforcement mechanism has the least operational overhead.

A. This is a reactive "detect and remediate" approach. It does not prevent the insecure rule from being created, leaving a window of vulnerability until the Lambda function executes.

B. AWS Config rules are a detective control used for auditing and identifying non-compliance. They report on non-compliant resources but do not prevent their creation.

C. Using an Allow statement in an SCP is not the standard or most effective way to create a restriction. An explicit Deny is stronger as it overrides any Allow permissions.

1. AWS Organizations User Guide

"Service control policies (SCPs)": This document explains that SCPs are a type of organization policy that you can use to manage permissions in your organization. It states

"SCPs offer central control over the maximum available permissions for all accounts in your organization." It also details the evaluation logic where an explicit deny in an SCP overrides any allow. (See the section "SCP evaluation").

2. AWS Identity and Access Management User Guide

"IAM JSON policy elements: Effect": This guide clarifies the policy evaluation logic

stating

"We recommend that you grant permissions by using a 'least-privilege' approach... You can also explicitly deny access to resources... An explicit deny statement always overrides an allow statement." This supports the choice of a Deny SCP over an Allow-based one for restriction.

3. AWS Identity and Access Management User Guide

"Actions

resources

and condition keys for Amazon EC2": This documentation lists the valid condition keys for EC2 actions. It shows that to filter based on the CIDR block being added to a rule

the correct condition key is ec2:Request/IpPermissions.IpRanges.CidrIp. While the question uses an incorrect key (aws:SourceIp)

the fundamental mechanism of using a Deny SCP (Option D) is the correct architectural pattern being tested.

An SCP is only a permissions filter; it never grants permissions by itself.

Because the shown SCP does not contain an explicit Deny for s3:CreateBucket, the action is still inside the account’s permission guard-rail.

Developers cannot create buckets because their IAM users/roles inside account 1111-1111-1111 lack an IAM policy that allows s3:CreateBucket.

Granting that permission in their IAM entities lets them create buckets while the SCP continues to apply to all other actions.

A. SCP “Allow” statements do not grant permissions; IAM must still permit the action.

B. Moving or re-attaching the identical SCP changes nothing about the missing IAM permission.

D. Detaching the SCP would work but removes the intended organizational control and is unnecessary; the problem is IAM, not the SCP.

1. AWS Organizations User Guide – “How SCPs Work”: “An SCP never grants permissions. Permissions must be granted with IAM policies.” (Guide version 2023-10-10

§‘Effects of SCPs’

para 2)

2. AWS Organizations User Guide – “Strategy for Using SCPs”: “A task is allowed only if it is permitted by both the SCP and the IAM policy.” (same guide

§‘Creating the right mix of policies’

para 1)

3. AWS IAM User Guide – “IAM Policies and Permissions”: “If no IAM policy allows the action

the request is denied.” (2023-11-15

§‘Policy evaluation logic’

step 4)

The most comprehensive source for AWS billing data is the AWS Cost and Usage Report (CUR). The CUR provides detailed, itemized data that can be delivered to an Amazon S3 bucket. To address the need for "meaningful groups," AWS Cost Categories allow the finance team to create custom rules to map costs to internal business structures, such as the different acquired companies, teams, or projects.

This raw data in S3 can be queried using Amazon Athena, a serverless interactive query service. Amazon QuickSight, a business intelligence service, can then connect to Athena as a data source. This enables the finance team to build their own custom dashboards and reports, fulfilling the requirement for a "self-managed application" for cost reporting.

B: AWS Cost Explorer is an AWS-managed visualization tool within the console. It does not meet the requirement for a "self-managed application" that the finance team can build upon.

C: The AWS Price List Query API provides the prices of AWS services. It does not provide information about an account's actual spending or usage, making it unsuitable for cost reporting.

D: This option has two flaws. The AWS Price List Query API does not provide account spending data, and AWS Cost Explorer does not meet the "self-managed application" requirement.

1. AWS Cost and Usage Reports (CUR): AWS Billing and Cost Management User Guide

"What are AWS Cost and Usage Reports?". It states

"The AWS Cost and Usage Reports (AWS CUR) contains the most comprehensive set of cost and usage data available." It also details delivery to an Amazon S3 bucket.

2. AWS Cost Categories: AWS Billing and Cost Management User Guide

"Managing your costs with AWS Cost Categories". This section explains

"Cost Categories is a feature in the AWS Cost Management product suite that enables you to group your cost and usage information into meaningful categories."

3. Querying CUR with Athena: AWS Cost and Usage Reports User Guide

"Querying Cost and Usage Reports using Amazon Athena". This guide provides a step-by-step walkthrough of setting up an AWS CloudFormation template to integrate CUR with Athena for querying.

4. Visualizing CUR with QuickSight: AWS Big Data Blog

"Create a cost and usage dashboard with Amazon QuickSight". This official blog post outlines the architecture: "This post shows you how to build a serverless solution that uses AWS Glue to crawl your CUR data in Amazon S3

Amazon Athena to query the data

and Amazon QuickSight to visualize the data."

5. AWS Price List Service API: AWS Price List Service API Reference

"Welcome". The introduction states

"AWS Price List Service API (AWS Price List Service) is a centralized and convenient way to programmatically query AWS for services

products

and pricing information." This confirms it is for pricing

not spending.

The most effective and native method for implementing canary releases for an AWS Lambda function is by using Lambda versions and aliases. A new function version is created for the new code. An alias, which acts as a mutable pointer to a function version, is then updated with a RoutingConfig. This configuration allows you to specify what percentage of invocation traffic is sent to the new version versus the stable, existing version. This gradual traffic shifting is the essence of a canary release, allowing for monitoring and a quick rollback by simply redirecting all traffic back to the old version if issues arise.

B: Using Route 53 is an inefficient, coarse-grained approach for a single Lambda function. It operates at the DNS level and would require separate application stacks or endpoints, adding unnecessary complexity and cost.

C: This is technically incorrect. The routing-config parameter is associated with a Lambda alias (update-alias command), not the function configuration itself (update-function-configuration command).

D: While AWS CodeDeploy automates Lambda canary deployments, CodeDeployDefault.OneAtATime is a deployment configuration for EC2/On-Premises instances, not for Lambda. Lambda uses time- or percentage-based shifting configurations (e.g., Canary10Percent5Minutes).

1. AWS Lambda Developer Guide: In the section "Configuring aliases for traffic shifting

" the documentation states

"You can use an alias to route traffic to two function versions. For example

you can configure an alias to send a small percentage of traffic to a new version that you're testing." This directly supports the use of aliases and routing configurations for canary releases.

Source: AWS Lambda Developer Guide

"Lambda function aliases

" section "Configuring aliases for traffic shifting."

2. AWS CLI Command Reference: The documentation for the update-alias command shows the --routing-config parameter. This parameter is used to "split traffic between two versions of a function." Conversely

the documentation for update-function-configuration does not include this parameter

confirming option C is incorrect.

Source: AWS CLI Command Reference

lambda

update-alias.

3. AWS CodeDeploy User Guide: The section "Deployment configurations on a Lambda compute platform" lists the predefined configurations available for Lambda deployments

such as CodeDeployDefault.LambdaCanary10Percent5Minutes and CodeDeployDefault.LambdaLinear10PercentEvery1Minute. The CodeDeployDefault.OneAtATime configuration is not listed for the Lambda compute platform.

Source: AWS CodeDeploy User Guide

"Working with deployment configurations in CodeDeploy

" section "Deployment configurations on a Lambda compute platform."

4. AWS CloudFormation User Guide: The documentation for the AWS::Lambda::Alias resource includes the RoutingConfig property. This property allows you to define AdditionalVersionWeights to split traffic between two function versions

confirming that this canary release strategy is fully supported within CloudFormation stacks.

Source: AWS CloudFormation User Guide

"AWS::Lambda::Alias

" RoutingConfig property.

The scenario describes a predictable workload with a weekly 4-hour peak that is double the average load. To minimize costs for such a pattern, the best approach is to match capacity to the load dynamically. AWS Application Auto Scaling for DynamoDB is designed for this exact purpose, automatically increasing provisioned capacity for the peak and decreasing it afterward. This avoids paying for unused peak capacity 24/7. Furthermore, purchasing reserved capacity for the consistent, average load provides a significant discount compared to on-demand or standard provisioned pricing, further optimizing costs for the baseline workload.

B: On-demand capacity mode is ideal for unpredictable workloads. For a predictable, cyclical workload like this, provisioned capacity with auto scaling is more cost-effective.

C: DynamoDB Accelerator (DAX) is an in-memory cache that primarily benefits read-heavy workloads. The scenario explicitly states the application has "many more writes," so DAX would provide little to no cost benefit.

D: This option is incorrect for two reasons: DAX is not effective for a write-heavy workload, and on-demand mode is less cost-effective than auto scaling for a predictable traffic pattern.

1. AWS DynamoDB Developer Guide

"Managing throughput capacity automatically with DynamoDB auto scaling": "DynamoDB auto scaling uses Application Auto Scaling to dynamically adjust provisioned throughput capacity on your behalf

in response to actual traffic patterns. This enables a table or global secondary index to increase its provisioned read and write capacity to handle sudden increases in traffic

without throttling requests." This supports using Auto Scaling for traffic pattern changes.

2. AWS DynamoDB Developer Guide

"Read/write capacity mode": "Provisioned mode is a good option if... you have predictable application traffic [and] you can forecast capacity requirements to control costs." This confirms provisioned mode with auto scaling is best for predictable traffic. It contrasts with on-demand

which is for "unpredictable application traffic."

3. AWS DynamoDB Developer Guide

"Reserved capacity": "With DynamoDB reserved capacity

you pay a one-time upfront fee and commit to a minimum provisioned usage level over a period of time. By reserving your read and write capacity units ahead of time

you can realize significant cost savings compared to standard provisioned capacity prices." This supports using reserved capacity for the average baseline load.

4. AWS DynamoDB Developer Guide

"Amazon DynamoDB Accelerator (DAX)": "DAX is intended for applications that are read-intensive... DAX is not ideal for applications that are write-intensive". This directly refutes the use of DAX in options C and D for this write-heavy scenario.

AWS Control Tower uses guardrails to implement governance policies. Guardrails are categorized as mandatory, strongly recommended, or elective. The requirement is to detect non-compliant resources (unencrypted RDS instances), which calls for a detective control.

In AWS Control Tower, detective guardrails are implemented using AWS Config rules. The [CT.RDS.2] Require encryption for RDS database instances guardrail is a pre-defined detective control that checks if RDS instances are encrypted. While this specific guardrail is categorized as "elective," the operational process is to enable an optional (non-mandatory) guardrail and apply it to a specific Organizational Unit (OU), such as the production OU. This aligns perfectly with the mechanism described in option B.

A. Mandatory guardrails are enabled by default on the entire organization's root OU when the landing zone is set up and cannot be selectively applied to specific OUs.

C. Users cannot create new mandatory guardrails in AWS Control Tower. While custom AWS Config rules can be created, they are not integrated as native Control Tower guardrails through this process.

D. Service Control Policies (SCPs) are preventive controls that deny API actions. They would be used to prevent the creation of unencrypted RDS instances, not to detect existing ones as the question requires.

---

1. AWS Control Tower User Guide

"Guardrails in AWS Control Tower": This document explains the different types of guardrails. It states

"You can enable strongly recommended and elective guardrails on specific OUs." This confirms that optional guardrails can be targeted to OUs like the production OU.

2. AWS Control Tower User Guide

"Guardrail reference": This reference lists all available guardrails. The guardrail [CT.RDS.2] Require encryption for RDS database instances is listed with a "Detective" behavior and is implemented as an "AWS Config rule". This confirms the existence of a specific detective guardrail for the required check.

3. AWS Control Tower User Guide

"How guardrails work": This section details the implementation. It clarifies that detective guardrails "detect noncompliance in your resources and provide alerts through the dashboard

" which matches the requirement to "detect" non-encrypted instances. It also distinguishes them from preventive guardrails

which use SCPs.

This solution meets all the stringent Recovery Point Objective (RPO) and Recovery Time Objective (RTO) requirements. AWS Elastic Disaster Recovery (DRS) uses continuous, block-level data replication for the EC2 instances, which can achieve an RPO of seconds, easily satisfying the 2-minute requirement. An Amazon RDS cross-Region read replica uses asynchronous replication, which typically has a lag of seconds to a few minutes, meeting the 5-minute database RPO. Promoting the read replica is a fast operation, meeting the 30-minute RTO. AWS Global Accelerator provides static IP addresses and intelligently routes traffic to the nearest healthy regional endpoint (the ALBs), ensuring rapid failover and optimal latency for users.

B: Amazon Data Lifecycle Manager (DLM) automates EBS snapshots, but the minimum creation frequency is one hour. This cannot meet the required 2-minute RPO for the application tier.

C: AWS Backup for EC2 instances is also based on snapshots, which have a minimum frequency of one hour, failing to meet the 2-minute RPO. CloudFront is a CDN, not the optimal service for this type of DR traffic routing.

D: This option fails for the same reason as option B. Amazon DLM's minimum snapshot frequency of one hour is insufficient to meet the 2-minute application RPO.

1. AWS Elastic Disaster Recovery (DRS): "AWS Elastic Disaster Recovery (DRS) minimizes downtime and data loss with fast

reliable recovery of on-premises and cloud-based applications... It enables an RPO of seconds and an RTO of minutes."

Source: AWS Documentation

"What is AWS Elastic Disaster Recovery?"

Introduction.

2. Amazon RDS Cross-Region Read Replicas: "You can reduce the risk of a regional disruption by using cross-Region read replicas as part of your disaster recovery strategy... In the event of a regional disruption

you can promote the read replica to be a new standalone DB instance."

Source: Amazon RDS User Guide

"Working with read replicas"

Section: "Cross-Region read replicas".

3. AWS Global Accelerator: "AWS Global Accelerator improves the availability and performance of your applications with local or global users... It provides static IP addresses that act as a fixed entry point to your application endpoints in a single or multiple AWS Regions... If there's a failure

Global Accelerator instantly directs traffic to the next available endpoint."

Source: AWS Documentation

"What Is AWS Global Accelerator?"

Introduction.

4. Amazon Data Lifecycle Manager (DLM): "You can create policies that create snapshots on a schedule. The schedule can be as frequent as every 1 hour."

Source: Amazon EC2 User Guide for Linux Instances

"Amazon Data Lifecycle Manager"

Section: "How Amazon DLM works".

This solution correctly establishes secure, private connectivity. Creating a private API Gateway endpoint makes the API accessible only from within a VPC, not from the public internet. An interface VPC endpoint for API Gateway (execute-api) creates a private network path from the EC2 instances' VPC to the API Gateway service, ensuring traffic does not traverse the public internet. Attaching a resource policy to the API that explicitly allows access only from the specified VPC endpoint provides a robust security layer, fulfilling all the company's requirements for private and secure communication.

A. An AWS Site-to-Site VPN connects a VPC to an on-premises network, not to a managed AWS service like API Gateway. This does not solve the private connectivity requirement.

C. IAM authentication provides authorization but does not make the API endpoint private. API Gateway cannot be "moved" into a VPC, and a transit gateway is for inter-VPC networking, not service access.

D. AWS Global Accelerator is designed to improve performance for public-facing applications by routing traffic over the AWS global network. It is for public, not private, endpoints.

1. AWS API Gateway Developer Guide

"Creating a private API in Amazon API Gateway": This guide states

"Private APIs are API endpoints that can only be accessed from your Amazon Virtual Private Cloud (VPC) through an interface VPC endpoint. This is an endpoint network interface that you create in your VPC." This directly supports using a private API endpoint type and a VPC endpoint.

2. AWS API Gateway Developer Guide

"Control access to a private API": This section details the use of resource policies. It explains

"To grant the access

you create a resource policy... and attach it to the API." It provides examples of policies that grant access based on the source VPC or VPC endpoint (aws:sourceVpce). This supports the resource policy and endpoint policy components of the answer.

3. AWS PrivateLink Guide

"Interface VPC endpoints (AWS PrivateLink)": This document explains the core technology. It states

"When you use an interface VPC endpoint

communication between your VPC and the AWS service is conducted entirely within the AWS network." This confirms that data does not traverse the public internet.