The AWS Cloud Operations and Compute documentation explains that placement groups control how EC2 instances are physically arranged within AWS data centers to optimize network performance.

Among the available placement strategies:

Cluster placement groups place instances physically close together within a single Availability Zone, connected through high-bandwidth, low-latency networking (ideal for tightly coupled, HPC, or distributed workloads).

Spread placement groups distribute instances across distinct racks or Availability Zones for fault tolerance, increasing latency.

Partition placement groups separate instances into partitions for isolation, not latency reduction.

Therefore, to minimize latency for workloads such as computational clusters, the CloudOps engineer should use a cluster placement group. This placement ensures single-digit microsecond latency and enhanced packet rate performance between instances.

Elastic IPs (Option B) do not influence internal networking. Jumbo frames (Option C) can marginally improve throughput but do not reduce propagation latency. Spread placement (Option D) increases distance, worsening latency.

Hence, Option A — using a cluster placement group — delivers the lowest possible network latency and is AWS’s best-practice design for HPC-style clusters.

Route 53 alias records are designed to map custom domain names to AWS resources such as ALBs, CloudFront distributions, and S3 website endpoints. Alias records behave like A records but point to AWS-managed resources instead of IP addresses.

Alias records are preferred over CNAME records because they can be used at the zone apex (example.com), do not incur additional DNS query charges, and automatically track changes to the underlying AWS resource.

A and AAAA records require fixed IP addresses, which ALBs do not provide. CNAME records cannot be used at the root domain.

Therefore, an alias record is the correct solution.

CloudWatch Logs metric filters allow log data to be converted into CloudWatch metrics in near real time. This enables continuous monitoring without custom code or scheduled queries. Metric filters are ideal when log events have a consistent structure and specific patterns, such as HTTP response codes.

By defining a metric filter that matches HTTP 404 responses, CloudWatch can increment a metric each time a 404 occurs. This metric can then be used for dashboards, alarms, and trend analysis. This approach is fully managed, scalable, and requires minimal operational effort.

Options B, C, and D rely on subscription filters or periodic queries, which introduce unnecessary complexity, latency, and maintenance overhead. Therefore, metric filters are the most efficient solution.

ALB access logs contain request-level records that include byte counts and target information. To report bytes sent to and received from each target group member, the CloudOps engineer should enable ALB access logging and store the logs in Amazon S3. Then Amazon Athena can query the log files and aggregate received_bytes and sent_bytes by the target address and port fields. AWS Athena documentation provides table definitions for ALB access logs and supports querying those logs directly from S3. Installing the CloudWatch agent on targets is unnecessary because the required data is in ALB logs, not instance OS metrics. The ProcessedBytes CloudWatch metric is useful for aggregate load balancer traffic but does not provide per-target member reporting. Grouping by client port is also wrong because the requirement is per target member.

===============

The AWS Cloud Operations and Content Delivery documentation explains that Amazon CloudFront caches objects in edge locations for a defined time based on TTL settings or origin headers. When new content is deployed to the S3 origin, previously cached versions remain in edge caches until they expire.

To immediately serve the new version, CloudOps engineers must initiate a CloudFront invalidation, which removes cached objects from all edge locations. This forces CloudFront to fetch the latest version from the origin (S3).

Invalidations can target individual objects (e.g., /index.html) or wildcard paths (e.g., /*) and are the AWS-recommended approach for dynamic content refresh after static site updates.

Changing headers (Option A), enforcing HTTPS (Option B), or applying caching policies (Option C) do not directly refresh outdated cache content.

Thus, Option D — issuing a CloudFront invalidation — ensures users receive the latest website content immediately after deployment.

According to the AWS Cloud Operations and Cost Management documentation, AWS Budgets is the recommended service to track and alert on cost thresholds across all AWS accounts and resources. It allows users to define cost, usage, or reservation budgets, and configure notifications to trigger when usage or cost reaches defined percentages of the budgeted value (e.g., 75%, 90%, 100%).

The AWS Budgets system integrates natively with Amazon Simple Notification Service (SNS) to deliver alerts to an email distribution list or SNS topic subscribers. AWS Budgets supports granular cost filters, including specific service categories such as data transfer, regions, or linked accounts, ensuring precise visibility into inter-Region transfer costs.

By contrast, CloudWatch billing alarms (Option B) monitor total account charges only and do not allow detailed service-level filtering, such as data transfer between Regions. Cost and Usage Reports (Option A) are for detailed cost analysis, not real-time alerting, and VPC Flow Logs (Option D) capture traffic data, not billing or cost-based metrics.

Thus, using AWS Budgets with a 75% alert threshold best satisfies the operational and notification requirements.

DynamoDB point-in-time recovery continuously backs up table data and can restore the table to a selected second within the recovery window. AWS documentation states that a PITR restore restores the data to a new table, not in place on the existing table. Therefore, the correct process is to restore the table to the timestamp two minutes before the corruption and then update the application to use the newly restored table. Option A is wrong because PITR does not update the existing table in place. Option C uses an on-demand snapshot, which might not meet the 2-minute RPO. Option D is unsafe because DynamoDB Streams are not a managed reverse-transaction rollback mechanism. PITR to a new table is the reliable recovery method.

===============

The correct design is to use a VPC endpoint/private connectivity model for Quick Suite access and grant the service controlled access to the S3 source data. The requirement is not only to access S3 privately; it says all data access and connections to Quick Suite must remain within the VPC network boundary. Option A best satisfies that by using an interface VPC endpoint with AWS PrivateLink for private service connectivity and a manifest that points Quick Suite to the S3 data. Option C covers only private access to S3 through a gateway endpoint, but it does not address private connectivity to Quick Suite itself. Option D sends traffic through a NAT gateway, which still uses public internet egress semantics. Option B adds an unnecessary EC2 proxy and increases operational risk.

===============

Stateful applications require session persistence to ensure that subsequent requests from the same user are routed to the same backend instance. When CloudFront is used in front of an ALB, session-related cookies must be forwarded correctly; otherwise, CloudFront can route requests to different targets, causing session loss and random logouts.

Configuring cookie forwarding in the CloudFront cache behavior ensures that session cookies (such as authentication tokens) are forwarded to the ALB and not stripped or cached incorrectly. Without this configuration, CloudFront may serve cached responses that do not align with the user’s active session state, leading to authentication issues.

On the ALB side, sticky sessions (session affinity) must be enabled on the target group to ensure that requests with the same session cookie are consistently routed to the same EC2 instance. ALB stickiness uses application cookies to bind a user session to a specific target, which is critical for stateful applications that store session data in memory.

Option A affects load distribution efficiency but does not address session persistence. Option C (header forwarding) is unnecessary unless the application explicitly stores session state in headers, which is uncommon. Option D applies only when using multiple target groups and listener rules, which is not the case here.

Together, enabling cookie forwarding in CloudFront and sticky sessions at the ALB target group resolves the logout issue by maintaining consistent session routing from the user through CloudFront to the same backend instance.

To detect CPU utilization issues within a 2-minute window, detailed monitoring is required. Basic monitoring publishes metrics at 5-minute intervals, which is too coarse to reliably detect a condition lasting only 2 minutes. Detailed monitoring publishes metrics at 1-minute granularity, allowing precise detection.

Amazon CloudWatch alarms support EC2 reboot actions directly, eliminating the need for custom Lambda functions. This minimizes administrative overhead and leverages native AWS integrations.

Options C and D introduce unnecessary complexity and delay. Option A cannot meet the timing requirement due to metric granularity.

Therefore, using a CloudWatch alarm with detailed monitoring and an EC2 reboot action is the correct solution.