Design a deployment strategy to meet business requirements

Vellacourt Insurance uses AWS Organizations with 140 member accounts in an organizational unit (OU) named Workloads. The platform team must deploy a standard set of IAM roles and an Amazon EventBridge rule to every account in Workloads and to every account added to that OU in the future, in two AWS Regions. A faulty template must not be rolled out to the whole organization at once: the deployment must stop after failures in more than two accounts.

Which two actions should the solutions architect take? Each correct answer presents part of the solution.

1. ACreate an AWS CloudFormation StackSet with service-managed permissions targeting the Workloads OU, and enable automatic deployment.Service-managed permissions use trusted access with Organizations, so no per-account administration roles are needed, and automatic deployment creates stack instances in accounts that join the target OU later.
2. BCreate an AWS CloudFormation StackSet with self-managed permissions and add each new account ID to the StackSet when it is created.Self-managed permissions require creating execution roles in every target account and do not support automatic deployment to new OU members, so each new account becomes a manual step.
3. CSet the StackSet operation preferences to a failure tolerance of 2 and a maximum concurrent account count that deploys to a small batch of accounts at a time.Failure tolerance stops the operation in a Region once more than the specified number of accounts fail, and limiting concurrency ensures only a small batch is affected before the operation halts.
4. DAttach a service control policy to the Workloads OU that denies cloudformation:CreateStack if the stack fails.SCPs filter permissions based on request context; they cannot react to stack failures and would not limit the blast radius of a rollout.
5. EUse an AWS CodePipeline pipeline with one CloudFormation deploy action per account and add a manual approval after each action.A pipeline with 280 account-and-Region actions is unmanageable, does not pick up new accounts automatically, and manual approvals add delay without enforcing a failure threshold.

Thornbury Media manages its production networking and database tier with an AWS CloudFormation stack named core-data. An engineer has edited the template to change the DBInstanceIdentifier of an Amazon RDS instance and the CIDR block of a subnet. The change advisory board requires that before any update is applied, reviewers see exactly which resources will be modified and whether any will be replaced.

What should the solutions architect do?

1. ARun drift detection on core-data and share the drift results with the reviewers.Drift detection compares the live resources with the current stack template. It does not preview the effect of a proposed new template.
2. BApply a stack policy that denies Update:Replace on all resources and run the update to see which resources fail.A stack policy can protect resources, but using failed updates as a preview is disruptive and gives reviewers no organized summary. It is a protection control, not a review mechanism.
3. CEnable termination protection on core-data and apply the update directly, relying on automatic rollback if a resource fails.Termination protection only prevents stack deletion. Rollback occurs after a failure, but a successful replacement of the database would still occur without any prior review.
4. DCreate a change set for core-data with the updated template and have the reviewers inspect the Replacement field for each resource change before executing it.A change set previews the proposed changes, including for each resource whether the update will modify it in place or replace it. Nothing changes until someone executes the change set.

Brindlecrest Telecom stores 20,000 recorded customer support calls per day as stereo audio files in an Amazon S3 bucket named support-calls. The quality team wants searchable transcripts that separate agent and customer speech, per-speaker sentiment, and detection of call issues. The company has no machine learning staff and wants results within two months.

Which solution should the solutions architect recommend?

1. ATrain a custom speech-to-text and sentiment model in Amazon SageMaker AI and deploy it to a real-time endpoint.Training and operating custom models requires data science skills and labeled data the company does not have, and is unlikely to deliver in two months.
2. BRun post-call analytics jobs with Amazon Transcribe Call Analytics, triggered by new objects in support-calls, and store the output for search.Transcribe Call Analytics is a pre-trained API designed for contact center audio. It produces transcripts with speaker separation, sentiment, issue detection and call characteristics without any model training.
3. CUse Amazon Rekognition to analyze the audio files and Amazon Comprehend to extract entities.Amazon Rekognition analyzes images and video, not audio speech, so it cannot produce transcripts.
4. DLoad the audio files into Amazon OpenSearch Service and use its built-in analyzers to index the speech content.OpenSearch indexes text; it does not convert audio to text or score sentiment, so a transcription service would still be needed.

Kestrelvale Logistics runs a three-node RabbitMQ cluster on Amazon EC2 instances that a two-person operations team patches, upgrades and monitors. Dozens of microservices publish and consume messages over AMQP 0-9-1 using existing RabbitMQ client libraries. Management wants to eliminate broker patching and node recovery work this quarter without changing application code.

Which solution meets these requirements?

1. AMove the brokers to Amazon MQ for RabbitMQ with a cluster deployment across multiple Availability Zones.Amazon MQ for RabbitMQ is a managed broker that supports the existing AMQP clients. AWS handles provisioning, patching and node replacement, and the cluster deployment spreads nodes across Availability Zones.
2. BMigrate the queues to Amazon SQS and replace the RabbitMQ client libraries with the AWS SDK.Amazon SQS is fully managed but does not speak AMQP, so every microservice would need code changes, which violates the constraint.
3. CContainerize RabbitMQ and run it as an Amazon ECS service on AWS Fargate with Amazon EFS for message persistence.Fargate removes host management, but the team would still own the RabbitMQ software, its upgrades, clustering and recovery.
4. DReplace the brokers with Amazon Managed Streaming for Apache Kafka (Amazon MSK) and use MSK Connect to bridge existing producers.Kafka uses a different protocol and consumption model, so producers and consumers would need to be rewritten or bridged, adding work rather than removing it.