This solution will meet the requirements because it will use a CloudFormation custom resource to execute custom logic during the stack set operation. A custom resource is a resource that you define in your template and that is associated with an AWS Lambda function. The Lambda function runs whenever the custom resource is created, updated, or deleted, and can perform any actions that are supported by the AWS SDK. In this case, the Lambda function can use the GuardDuty API to check whether GuardDuty is already enabled in each target account, and if not, enable it. This way, the DevOps engineer can avoid deploying the stack set to accounts that already have GuardDuty enabled, and prevent failure during the deployment.

Ensure that the Amazon CloudWatch agent is installed on all EC2 instances:
* The Amazon CloudWatch agent collects and logs metrics and sends them to Amazon CloudWatch.
* To install the CloudWatch agent:
* Download the CloudWatch agent package.
* Install the agent on your EC2 instances.
* Configure the agent to collect disk space metrics.
Create an Amazon CloudWatch alarm to monitor available disk space on all EC2 instances Add the alarm as a safety control to the Systems Manager Automation task:
* Create CloudWatch alarms to monitor the available disk space and trigger notifications or actions when the disk space falls below a defined threshold.
* Add the CloudWatch alarm to the Systems Manager Automation task to halt or fail the task if disk space is insufficient.
* To create the alarm:
* Navigate to the CloudWatch console and create a new alarm.
* Set the metric to monitor (e.g., disk space utilization).
* Define the threshold and notification actions.
References:
* Amazon CloudWatch agent
* Creating Amazon CloudWatch alarms

You need to understand how SCP inheritance works in AWS. The way it works for Deny policies is different that allow policies.
Allow polices are passing down to children ONLY if they don't have an allow policy.
Deny policies always pass down to children.
That's why there is always an SCP set to the Root to allow everything by default. If you limit this policy, the whole organization will be limited, not matter what other policies are saying for the other OUs. So it's not A.
It's not D because it restricts the wrong OU.

Action-level states in events
Action state Description
STARTED The action is currently running.
SUCCEEDED The action was completed successfully.
FAILED For Approval actions, the FAILED state means the action was either rejected by the reviewer or failed due to an incorrect action configuration.
CANCELED The action was canceled because the pipeline structure was updated.