A. Incorrect.
S3 website redirection is used when redirecting requests to another host or path. It does not serve the bucket's static website content.

B. Incorrect.
There is no WEBSITE ACL permission. Public static website access should be controlled with an object read policy or appropriate object permissions.

C. Incorrect.
AuthenticatedUsers means any AWS principal, not anonymous website visitors. It also does not configure website hosting.

D. Correct.
The bucket must allow public read access to the website objects, commonly with a bucket policy that permits s3:GetObject on the object ARN pattern.

E. Correct.
Static website hosting must be enabled and an index document such as index.html must exist in the bucket.

A. Incorrect.
EBS encryption cannot be disabled in place, and replacing a key pair does not fix Windows Firewall rules.

B. Incorrect.
Amazon Inspector identifies vulnerabilities. It does not modify Windows Firewall settings on an offline boot volume.

C. Incorrect.
EBS encryption cannot be toggled off and on for an existing volume, and Inspector cannot repair RDP firewall rules.

D. Correct.
EC2Rescue for Windows can repair common Windows connectivity problems by mounting the root volume on a helper instance and updating offline settings.

A. Correct.
Denying organizations:LeaveOrganization with an SCP prevents member accounts from leaving the organization.

B. Incorrect.
RemoveAccountFromOrganization is used by the management account to remove an account. It does not stop a member account from leaving on its own.

C. Incorrect.
A custom Lambda workflow is unnecessary and incomplete because SCPs are the organization-level guardrail.

D. Incorrect.
AWS Config can detect whether an account is part of an organization, but it does not enforce prevention.

A. Correct.
Each subnet uses its associated route table. The new subnets need routes for on-premises CIDR ranges that target the virtual private gateway.

B. Incorrect.
VPN route configuration is not Availability Zone-specific in this way. The subnet route tables are the likely missing piece.

C. Incorrect.
A virtual private gateway is attached to the VPC, not to a single Availability Zone. A new VPN is not required for new subnets.

D. Incorrect.
Direct Connect can be useful for dedicated connectivity, but it is not required to fix missing route table entries.

A. Incorrect.
Manual stack creation in 50 accounts is operationally heavy and error-prone.

B. Incorrect.
A shell script is custom automation and lacks StackSets' built-in multi-account deployment and update management.

C. Incorrect.
Lambda plus DynamoDB is unnecessary custom orchestration for a standard multi-account infrastructure deployment.

D. Correct.
CloudFormation StackSets are designed to deploy and update the same stack across multiple accounts and Regions centrally.

A. Correct.
An organization-based AWS Config aggregator centralizes compliance data from multiple accounts and Regions.

B. Incorrect.
Creating separate aggregators in every account increases overhead and does not provide the clean centralized reporting path.

C. Correct.
Deploying the managed rule organization-wide ensures consistent evaluation of public-read protection for S3 buckets.

D. Incorrect.
The management account alone does not automatically contain all resource compliance data unless aggregation is configured.

E. Incorrect.
Manual per-account API deployment is unnecessary compared with organization-level Config rule deployment.

A. Correct.
By default, stack creation failure triggers rollback, and the stack is deleted after resources are rolled back.

B. Incorrect.
CloudFormation can preserve failed stacks only when rollback behavior is changed. It is not the default behavior.

C. Incorrect.
CloudFormation does not prompt interactively during stack creation failure.

D. Incorrect.
A failed required resource causes stack creation to fail, not complete successfully.

A. Incorrect.
Reusable templates help, but manual deployment in each account is still high overhead.

B. Incorrect.
Directory Service can integrate identity, but it does not deploy IAM role resources across AWS accounts.

C. Incorrect.
AWS RAM shares supported resources; it is not the right service to create and manage IAM roles in each account.

D. Correct.
StackSets with Organizations can centrally deploy and update IAM role stacks across multiple accounts.

A. Incorrect.
Static website visitors need object read access. Granting access only to the bucket does not allow reading the website files.

B. Correct.
Public website access requires s3:GetObject permission on the object ARN pattern, such as arn:aws:s3:::bucket-name/*.

C. Incorrect.
There is no default bucket policy denying public reads. Default S3 settings block public access unless changed.

D. Incorrect.
CORS controls browser cross-origin requests. It does not fix basic anonymous object read permissions.

A. Incorrect.
Latency routing chooses the lowest-latency endpoint, not a location-defined data residency target.

B. Incorrect.
Multivalue answer routing returns multiple healthy records and is not based on user geography.

C. Correct.
Geolocation routing returns DNS answers based on the user's geographic location, which supports data residency routing needs.

D. Incorrect.
IP-based routing can map client CIDR ranges to answers, but geolocation routing is the direct fit for geography-based policy.