A. Incorrect.
S3 is durable object storage, but it is not optimized for low-latency, high-frequency session reads and writes.

B. Incorrect.
FSx for Windows File Server is not the right shared session store for a Linux web fleet and would add file-system complexity.

C. Incorrect.
EBS Multi-Attach has strict limitations and does not provide a distributed session cache for horizontally scaled web servers.

D. Correct.
ElastiCache for Redis is an in-memory data store commonly used for high-throughput, low-latency session storage.

A. Incorrect.
Removing the root guardrails would weaken controls for all accounts and does not directly solve the SCP inheritance problem.

B. Incorrect.
SCPs do not grant permissions. A lower-level SCP cannot allow an action that a root-level SCP denies.

C. Incorrect.
Converting the entire organization policy model creates unnecessary long-term maintenance and risk.

D. Correct.
Moving restrictive SCPs from the root to the Production OU lets the temporary Onboarding OU avoid those denies while production accounts remain governed.

A. Correct.
SNS fanout to SQS queues is a proven pub/sub pattern. Each account gets its own durable queue, and each microservice consumes independently.

B. Incorrect.
A single SQS queue distributes each message to one consumer rather than giving every microservice its own copy.

C. Incorrect.
Kinesis consumers can read streams, but it is not the lowest-friction cross-account fanout pattern for independent microservices.

D. Incorrect.
Polling S3 adds latency and operational complexity compared with managed messaging fanout.

A. Incorrect.
With one SQS queue, one consumer can remove the message before other microservices see it unless additional fanout queues are built.

B. Incorrect.
DynamoDB does not provide direct table event notifications to SNS in this form for application-level domain events.

C. Correct.
EventBridge supports decoupled event-driven architectures, filtering, and routing to multiple targets when a domain event such as user deletion occurs.

D. Incorrect.
Polling introduces delay and unnecessary read load, and it is not an immediate deletion pattern.

A. Correct.
SNS with an email subscription is a simple managed notification target.

B. Correct.
Step Functions can publish to SNS through an integrated service task or a Lambda task.

C. Correct.
Catch with States.ALL on relevant state types routes broad failures to the notification path.

D. Incorrect.
SES is not required for simple operational email notifications from a workflow.

E. Incorrect.
states.Runtime catches only one class of error and would miss other failures.

F. Incorrect.
Lambda DLQs apply to Lambda invocation failures and do not reliably capture all Step Functions state machine failures.

A. Correct.
DynamoDB write throttling indicates the table or partition write capacity is insufficient for the workload.

B. Incorrect.
More memory can reduce duration for CPU-bound functions, but it does not solve DynamoDB write throttling or high invocation pressure by itself.

C. Incorrect.
Larger payloads would usually make the workload heavier.

D. Correct.
Kinesis buffers high-throughput ingestion and lets Lambda process records in batches, reducing invocation pressure and smoothing spikes.

E. Incorrect.
A single FIFO queue with strict ordering can limit throughput and does not fit high-volume meter ingestion.

A. Correct.
Secrets Manager stores secrets encrypted and can invoke custom Lambda rotation logic for SSH key pair replacement.

B. Incorrect.
Plain String parameters are not encrypted, and manual rotation increases downtime and operational effort.

C. Incorrect.
KMS key rotation rotates KMS key material; it does not rotate EC2 SSH key pairs.

D. Incorrect.
Fleet Manager can help manage instances, but by itself it does not provide encrypted secret storage and complete key rotation workflow.

A. Correct.
In AWS Organizations, the management account can activate cost allocation tags and generate Cost and Usage Reports that include tag-based cost breakdowns.

B. Incorrect.
Cost allocation tags are managed for billing from the payer or management account, and manual aggregation is unnecessary.

C. Incorrect.
Trusted Advisor is not the tool for authoritative monthly CUR tag-based cost allocation.

D. Incorrect.
AWS Config tracks resource configuration, not billing usage charges.

A. Correct.
AWS managed keys do not provide customer-controlled rotation periods. Re-encrypting via snapshot restore to a customer managed key plus a custom Config rule satisfies the 180-day compliance check.

B. Incorrect.
You cannot simply change the KMS key of an existing encrypted Aurora cluster in place.

C. Incorrect.
AWS managed KMS key rotation settings are controlled by AWS and cannot be set to a custom 180-day period.

D. Incorrect.
SES sends email; it does not evaluate KMS compliance.

A. Incorrect.
Weight affects distribution among weighted records, but health evaluation must detect failure for failover behavior.

B. Correct.
If alias target health is not evaluated, the parent latency record may continue to appear healthy.

C. Correct.
Without health checks on the weighted records, Route 53 may not know that the underlying servers are unavailable.

D. Incorrect.
Routing policies can be combined through record hierarchies such as latency alias records pointing to weighted records.

E. Incorrect.
Lower latency in the healthy Region would help route traffic there only if the failed Region is correctly marked unhealthy.