A. Incorrect.
Manual graph review is time-consuming and does not provide managed right-sizing recommendations for IOPS and throughput.

B. Incorrect.
EBS-optimized instances improve instance-to-EBS performance but do not right-size volume provisioning.

C. Correct.
AWS Compute Optimizer analyzes utilization metrics and provides EBS volume right-sizing recommendations.

D. Incorrect.
Manual benchmarking with fio adds operational overhead and does not scale well across many instances and volumes.

A. Incorrect.
KMS key rotation rotates encryption keys, not database login credentials.

B. Incorrect.
KMS does not rotate DB credentials, and read replicas do not help write-intensive connection spikes.

C. Correct.
Secrets Manager can rotate database credentials, and RDS Proxy pools and manages client connections during spikes.

D. Incorrect.
Secrets Manager solves credential rotation, but read replicas are for read scaling and do not address write connection storms.

A. Incorrect.
A single EBS volume is Availability Zone-scoped and is not the scalable shared file system choice for many instances across AZs.

B. Correct.
Amazon EFS provides a managed, elastic NFS file system that can be mounted from EC2 instances across multiple AZs.

C. Incorrect.
Self-managed file sharing on EC2 adds administration and availability risk.

D. Incorrect.
Storage Gateway is primarily for hybrid storage integration and is not the simplest scalable shared file system for EC2 in a VPC.

A. Incorrect.
Security groups allow network access but do not require clients to use SSL.

B. Incorrect.
KMS encryption protects storage at rest. It does not enforce encrypted client connections.

C. Correct.
For RDS PostgreSQL, the rds.force_ssl parameter can enforce SSL/TLS connections.

D. Incorrect.
RDS PostgreSQL supports SSL/TLS without a custom extension.

A. Correct.
HealthyHostCount at zero indicates that the load balancer has no healthy targets.

B. Incorrect.
One unhealthy target does not mean all targets are unhealthy.

C. Incorrect.
StatusCheckFailed <= 0 means EC2 status checks are not failing, which is not the problem condition.

D. Incorrect.
EC2 status checks do not represent ALB target group health for all targets.

A. Incorrect.
Standard Reserved Instances are less flexible and are tied to attributes such as Region and instance family.

B. Incorrect.
EC2 Instance Savings Plans apply to a selected instance family in a Region and are not Region-independent.

C. Incorrect.
Convertible Reserved Instances provide some flexibility but are still not as Region-flexible as Compute Savings Plans.

D. Correct.
Compute Savings Plans apply across Regions and instance families for eligible compute usage during the commitment.

A. Correct.
CloudWatch alarms can emit state changes to EventBridge, which can automate the reboot workflow with low operational overhead.

B. Incorrect.
Amazon SES sends email. It does not reboot EC2 instances.

C. Incorrect.
A Lambda function can work, but it adds custom code and operational overhead compared with a direct event-driven automation path.

D. Incorrect.
EC2 health checks do not monitor file system disk usage by default.

A. Correct.
CloudTrail log file integrity validation creates digest files, and the AWS CLI can validate whether logs were changed or deleted.

B. Incorrect.
The processing library is not required for the standard validation workflow.

C. Incorrect.
CloudTrail Insights detects unusual API activity, not log file tampering.

D. Incorrect.
CloudWatch Logs can receive events but does not provide CloudTrail S3 log integrity validation.

A. Incorrect.
CloudWatch Logs collects application or system logs, not ENI-level network flow records by itself.

B. Correct.
VPC Flow Logs capture traffic metadata for elastic network interfaces.

C. Correct.
awsvpc mode gives each task its own ENI, enabling task-level flow log visibility.

D. Incorrect.
Bridge mode shares host networking through Docker bridge and does not provide a unique ENI per task.

E. Incorrect.
Host mode uses the container instance network stack and does not provide per-task ENIs.

A. Correct.
The Retain deletion policy tells CloudFormation to leave the DynamoDB table in place when the stack is deleted.

B. Incorrect.
Snapshot deletion policy is not the correct retention mechanism for DynamoDB tables in this scenario.

C. Incorrect.
Termination protection prevents deleting the stack at all, which does not meet the requirement to delete the stack.

D. Incorrect.
An application IAM policy is not the right CloudFormation-controlled way to preserve the table during stack deletion.