A. Incorrect.
Macie is for sensitive data discovery in S3 and does not provide the lowest-effort request-count analysis for existing CloudWatch logs.

B. Incorrect.
OpenSearch can analyze logs, but streaming and indexing adds implementation work that is unnecessary for a 7-day investigation.

C. Correct.
Logs Insights can filter by IP address, parse URLs, aggregate counts, and limit the query to the last 7 days directly in the existing log group.

D. Incorrect.
S3, Glue, and Athena can work, but they require moving and cataloging data that is already searchable in CloudWatch Logs.

A. Correct.
IAM Access Analyzer policy generation uses CloudTrail activity to produce a policy template that reflects observed service and action usage.

B. Incorrect.
Policy validation checks policy syntax and security warnings; it does not generate a usage-based policy.

C. Incorrect.
Manual log review is possible but higher effort and more error-prone.

D. Incorrect.
Trusted Advisor can flag broad security issues, but it does not generate a least-privilege policy from role usage.

A. Incorrect.
Federated users authenticate with the external identity provider, so IAM password policy does not control their Active Directory passwords.

B. Correct.
Cognito user pools have their own password policy settings for users stored in the pool.

C. Correct.
For IAM federation backed by Active Directory, password length must be enforced in Active Directory.

D. Incorrect.
SCPs restrict AWS API permissions. They do not set password policy for external directories or Cognito user pools.

E. Incorrect.
IAM policies authorize actions; they do not define password-complexity rules for these identity sources.

A. Incorrect.
TLS termination at the load balancer breaks strict end-to-end TLS from client to container, even if the next hop is re-encrypted.

B. Incorrect.
This terminates TLS at the ALB and sends unencrypted HTTP to the tasks, which violates the requirement.

C. Correct.
An NLB TCP listener operates at Layer 4, scales for volatile traffic, has low latency, and lets the container terminate the original TLS session.

D. Incorrect.
DNS routing does not provide health-aware high-scale load balancing for dynamic ECS tasks in the same way as an NLB.

A. Incorrect.
AWS Config evaluates resource configuration, not sensitive content inside S3 objects.

B. Incorrect.
Custom scanning creates operational overhead and is less complete than a managed sensitive data discovery service.

C. Correct.
Macie managed data identifiers detect common sensitive data types in S3. Macie findings can be routed through EventBridge to the existing SNS topic.

D. Incorrect.
GuardDuty detects threats and anomalous activity; it does not classify sensitive data stored in objects.

A. Correct.
CloudTrail Lake is a managed event data store for CloudTrail events with SQL queries, retention controls, and dashboard support without operating analytics infrastructure.

B. Incorrect.
Event History is limited and is not a 7-year searchable analytics store for data events.

C. Incorrect.
EMR can query S3 data, but a persistent cluster is higher operational overhead and cost for this requirement.

D. Incorrect.
OpenSearch can visualize logs, but keeping a large domain for long-term retention is usually less cost-effective than a purpose-built CloudTrail Lake store.

A. Incorrect.
A key alias identifies a key, but it is not authenticated data and does not bind context to ciphertext.

B. Incorrect.
A broad decrypt permission does not protect against ciphertext being used in the wrong context.

C. Correct.
KMS encryption context is additional authenticated data. Decrypt must include the same context, and policies can require expected context keys and values.

D. Incorrect.
Rotation changes future key material, but it does not provide per-ciphertext authenticated context.

A. Correct.
Session Manager uses the SSM agent, instance profile, IAM, and private service endpoints. It avoids inbound RDP exposure and can continue working after external network paths are blocked.

B. Incorrect.
Keeping VPN access open conflicts with the requirement to block external access to the VPC during an incident.

C. Incorrect.
Public IP addresses and RDP exposure increase risk during an incident.

D. Incorrect.
IAM access keys do not provide Windows remote desktop access and would introduce long-term credential risk.

A. Correct.
Account-level S3 Block Public Access provides broad preventive protection against public bucket policies, public ACLs, and accidental exposure across buckets in the account.

B. Incorrect.
Object-by-object controls are high overhead and do not protect new buckets consistently.

C. Incorrect.
Disabling ACLs is helpful, but allowing public bucket policies still leaves an exposure path.

D. Incorrect.
PrivateLink changes network access paths but does not by itself prevent public S3 policies or ACLs.

A. Incorrect.
KMS keys are Regional resources, so a single-Region key ARN cannot be used as the local key in another Region.

B. Incorrect.
Hard-coding Region-specific key IDs makes multi-Region deployment harder to maintain.

C. Correct.
Each Region needs its own KMS key unless a multi-Region key design is intentionally used. Using the same alias name lets the application use consistent configuration while each Region resolves the alias locally.

D. Incorrect.
AWS managed keys are service scoped, not customer-controlled shared keys for this custom application pattern.