The correct answer is B and C. Option B is correct because inviting the acquired company's AWS accounts to join the organization and creating the OrganizationAccountAccessRole IAM role in the invited accounts allows the management account to assume the role and gain full administrative access to the member accounts. Option C is correct because using AWS Security Hub to collect and group findings across all accounts enables the DevOps team to monitor and improve the security posture of the organization. Security Hub can automatically detect new accounts as the accounts are added to the organization and enable Security Hub for them. Option A is incorrect because creating an SCP that has full administrative privileges and attaching it to the management account does not grant the management account access to the member accounts. SCPs are used to restrict the permissions of the member accounts, not to grant permissions to the management account. Option D is incorrect because using AWS Firewall Manager to collect and group findings across all accounts is not a valid use case for Firewall Manager. Firewall Manager is used to centrally configure and manage firewall rules across the organization, not to collect and group security findings. Option E is incorrect because using Amazon Inspector to collect and group findings across all accounts is not a valid use case for Amazon Inspector. Amazon Inspector is used to assess the security and compliance of applications running on Amazon EC2 instances, not to collect and group security findings across accounts. References:
* Inviting an AWS account to join your organization
* Enabling and disabling AWS Security Hub
* Service control policies
* AWS Firewall Manager
* Amazon Inspector

EKS control plane nodes are fully managed by AWS and are not accessible for configuration, SSH, SSM commands, or custom workloads. Therefore, any prefetching of container images must occur on the worker nodes (EC2 instances in the node groups) because those are the machines that pull and cache container images before running pods.
Option C is the only solution that aligns with AWS architecture:
It creates an IAM role allowing Systems Manager Run Command to execute on EC2 worker nodes.
It uses node group tags to target the correct nodes dynamically.
State Manager runs the prefetch script whenever triggered by the EventBridge automation - ensuring newly added nodes pre-pull images and reduce cold-start latency to seconds.
Options A and D are invalid because you cannot run Systems Manager commands on EKS control plane nodes; AWS manages them and does not expose them. Option B incorrectly targets node groups based on machine size, which does not provide reliable node identification or filtering.
Thus, Option C provides the correct, scalable, and supported method for prefetching images across all worker nodes.

The "fan-out" batch build type in AWS CodeBuild allows running multiple builds in parallel for different subsets of tests, reducing overall test execution time. CodeBuild then aggregates the results into a single consolidated report. This approach is detailed in the AWS documentation under "Batch builds and parallel execution with CodeBuild."

it involves adding an IPv6 CIDR block to the VPC and subnets for the ALB and specifying the dualstack IP address type on the ALB listener. This allows the ALB to listen on both IPv4 and IPv6 addresses, and forward requests to the EC2 instances that are added as targets to the target group associated with the ALB.

Amazon EventBridge can directly consume AWS Health events as an event source. You can specify event types such as "AWS_EC2_INSTANCE_RETIREMENT_SCHEDULED" or
"AWS_EC2_INSTANCE_TERMINATION_SCHEDULED." The rule's target should invoke the Systems Manager Automation document (runbook) AWS-RestartEC2Instance to automate the restart within a defined maintenance window. This event-driven automation pattern is described in AWS documentation:
"Automating AWS Health event remediation using EventBridge and Systems Manager."