Option A directly matches all requirements with the least extra infrastructure:

State Manager is the Systems Manager capability for defining and maintaining a desired configuration by running associations on a schedule (for example, hourly). That satisfies the “run periodically” requirement in a managed way across a large fleet.

The AWS-ApplyChefRecipes Systems Manager document is specifically intended to run Chef recipes/cookbooks on managed instances without requiring you to run your own Chef server infrastructure . You can point it at a cookbook source (such as an artifact/repo location) and have Systems Manager handle execution on the instances.

Why the other options aren’t correct:

B is not the right mechanism for periodic Chef cookbook execution. Installing an application package and running a “repair action” via Run Command is not the purpose-built Chef cookbook runner, and it’s more brittle/DIY than State Manager associations.

C ( AWS-RefreshAssociation ) is used to refresh/reevaluate association metadata/targets; it does not itself execute Chef cookbooks as the compliance mechanism.

D is for OS patching compliance (Patch Manager/patch policies), not for applying Chef cookbooks that detect and remediate configuration drift.

Step 1: Reacting to RDS Storage Autoscaling Events Using Amazon EventBridgeAmazon RDS emits events when storage autoscaling occurs. To visualize these events in a CloudWatch dashboard, you can create an EventBridge rule that listens for these specific autoscaling events.

Action: Create an EventBridge rule that reacts to RDS storage autoscaling events from the RDS event stream.

Why: EventBridge allows you to listen to RDS events and route them to specific AWS services for processing.

Step 2: Creating a Custom CloudWatch Metric via LambdaOnce the EventBridge rule detects a storage autoscaling event, you can use a Lambda function to publish a custom metric to CloudWatch. This metric can then be visualized in a CloudWatch dashboard.

Action: Use a Lambda function to publish custom metrics to CloudWatch based on the RDS storage autoscaling events.

Why: Custom metrics allow you to track specific events like autoscaling and visualize them easily on a CloudWatch dashboard.

The company’s requirements span preventive governance , account baseline configuration , and continuous compliance monitoring , all with minimal operational overhead. AWS-native, organization-level services are the most efficient way to meet these goals.

To ensure that new accounts do not retain default VPCs and that development is restricted to specific Regions , AWS Control Tower is the correct foundation. However, Control Tower alone does not remove default VPCs. By installing Customizations for AWS Control Tower (CfCT) , the company can automatically deploy OU-scoped CloudFormation templates during account provisioning. A simple CloudFormation template can delete default VPCs in all Regions, while Control Tower-managed Region deny guardrails (SCPs) restrict access to only approved Regions. This approach is declarative, repeatable, and tightly integrated with account creation workflows, resulting in low operational overhead.

For CIS AWS Foundations Benchmark compliance monitoring , AWS Security Hub is the purpose-built service. Enabling Security Hub at the organization level and selecting the CIS benchmark automatically evaluates all member accounts against CIS controls and continuously reports findings. This provides centralized visibility and compliance reporting without custom rule development.

Option C introduces custom Lambda automation and EventBridge logic, increasing maintenance burden. Option E is incorrect because Control Tower does not provide full CIS benchmark monitoring; it only offers related detective guardrails.

Therefore, Option B (Control Tower + CfCT) and Option D (Security Hub with CIS benchmark) together provide the most efficient, scalable, and AWS-recommended solution.

ALB natively supports WebSocket protocols and sticky sessions via target group session affinity. Deploying ALBs in multiple regions with cross-zone load balancing ensures high availability and fault tolerance.

Using Route 53 latency-based routing allows users worldwide to connect to the lowest latency region, minimizing delay.

NLBs do not support sticky sessions and WebSocket protocol as well as ALBs do. Combining ALBs and NLBs (Option D) increases complexity. CloudFront (Option C) does not natively support WebSocket sticky sessions.

Option A is the simplest, most effective solution meeting all requirements with least operational overhead.

The most operationally efficient solution is to use AWS Systems Manager Parameter Store1 to store the AMI ID and reference it in the launch template2. This way, the launch template does not need to be updated every time a new AMI is created by Image Builder. Instead, the Image Builder pipeline can update the Parameter Store value with the newest AMI ID3, and the Auto Scaling group can launch instances using the latest value from Parameter Store.

The other solutions require updating the launch template or creating a new version of it every time a new AMI is created, which adds complexity and overhead. Additionally, using EventBridge rules and Lambda functions or Run Command documents introduces additional dependencies and potential points of failure.

 1: AWS Systems Manager Parameter Store 2: Using AWS Systems Manager parameters instead of AMI IDs in launch templates 3: Update an SSM parameter with Image Builder

https://docs.aws.amazon.com/config/latest/developerguide/ec2-ebs-encryption-by-default.html

To scale microservice Pods based on CPU utilization, the Kubernetes Horizontal Pod Autoscaler (HPA) uses the Kubernetes Metrics Server to monitor resource usage and automatically adjusts the number of Pods. However, scaling Pods may require additional nodes if the current node capacity is insufficient.

The Cluster Autoscaler works with EKS managed node groups to add or remove worker nodes based on pending Pod requirements and resource usage.

By deploying both HPA and Cluster Autoscaler, the system can automatically scale Pods and add nodes as necessary, ensuring efficient resource utilization and availability.

Configuring the Cluster Autoscaler with auto-discovery allows it to manage node groups without manual intervention, reducing operational effort.

Option A only scales nodes based on node CPU utilization, not Pods.

Option B uses VPA recommender mode, which only suggests resource changes and does not scale automatically.

Option C involves manual updates and is not automated scaling. Therefore, option D provides the most operationally efficient, fully automated scaling solution.

Reference from AWS Official Documentation:

Kubernetes Horizontal Pod Autoscaler: " HPA automatically scales the number of Pods based on observed CPU utilization or other metrics. " (Kubernetes HPA)

Cluster Autoscaler on Amazon EKS: " The Cluster Autoscaler automatically adjusts the size of the Kubernetes cluster when there are Pods that fail to run due to insufficient resources or when nodes in the cluster are underutilized. " (AWS EKS Cluster Autoscaler)

EC2 instances running in private subnets of a VPC can now have controlled access to S3 buckets, objects, and API functions that are in the same region as the VPC. You can use an S3 bucket policy to indicate which VPCs and which VPC Endpoints have access to your S3 buckets 1- https://aws.amazon.com/pt/blogs/aws/new-vpc-endpoint-for-amazon-s3/

The correct answer is A.

Option A is correct because it meets the requirements with the most operational efficiency. Updating the ecommerce application to emit a JSON object to a CloudWatch log group for each processed transaction is a simple and cost-effective way to collect the data needed for the dashboard. Using CloudWatch Logs Insights to query the log group and to visualize the results in a pie chart format is also a convenient and integrated solution that leverages the existing CloudWatch dashboards. Attaching the results to the desired CloudWatch dashboard is straightforward and does not require any additional steps or services.

Option B is incorrect because it introduces unnecessary complexity and cost. Updating the ecommerce application to emit a JSON object to an Amazon S3 bucket for each processed transaction is a valid way to store the data, but it requires creating and managing an S3 bucket and its permissions. Using Amazon Athena to query the S3 bucket and to visualize the results in a pie chart format is also a valid way to analyze the data, but it incurs charges based on the amount of data scanned by each query. Exporting the results from Athena and attaching them to the desired CloudWatch dashboard is also an extra step that adds more overhead and latency.

Option C is incorrect because it uses AWS X-Ray for an inappropriate purpose. Updating the ecommerce application to use AWS X-Ray for instrumentation is a good practice for monitoring and tracing distributed applications, but it is not designed for aggregating product transaction details. Creating a new X-Ray subsegment and adding an annotation for each processed transaction is possible, but it would clutter the X-Ray service map and make it harder to debug performance issues. Using X-Ray traces to query the data and to visualize the results in a pie chart format is also possible, but it would require custom code and logic that are not supported by X-Ray natively. Attaching the results to the desired CloudWatch dashboard is also not supported by X-Ray directly, and would require additional steps or services.

Option D is incorrect because it introduces unnecessary complexity and cost. Updating the ecommerce application to emit a JSON object to a CloudWatch log group for each processed transaction is a simple and cost-effective way to collect the data needed for the dashboard, as in option A. However, creating an AWS Lambda function to aggregate and write the results to Amazon DynamoDB is redundant, as CloudWatch Logs Insights can already perform aggregation queries on log data. Creating a Lambda subscription filter for the log file is also redundant, as CloudWatch Logs Insights can already access log data directly. Attaching the results to the desired CloudWatch dashboard would also require additional steps or services, as DynamoDB does not support native integration with CloudWatch dashboards.