IAM Access Analyzer analyzes permissions granted using policies to determine what resources are shared with an external entity, and helps identify excessive permissions or least privilege violations across all accounts in an AWS Organization. It is specifically designed for reviewing and refining IAM permissions with minimal administrative effort.
AWS Documentation Extract:
"IAM Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. You can also use Access Analyzer policy checks to refine permissions and implement least privilege." (Source: IAM Access Analyzer documentation) A: Network Access Analyzer is for VPC network access analysis, not IAM permissions.
B: CloudWatch alarms are not suitable for detailed permission analysis.
D: Amazon Inspector is for security vulnerability assessment, not IAM policy review.
Reference: AWS Certified Solutions Architect - Official Study Guide, IAM Security Analysis.

AWS Security Hub provides a centralized view of security findings across AWS accounts and services. It integrates natively with AWS Config conformance packs, which evaluate compliance against industry standards such as CIS and PCI-DSS.
From AWS Documentation:
"AWS Security Hub aggregates, organizes, and prioritizes security alerts and compliance status across AWS accounts. Use AWS Config conformance packs to assess compliance with security frameworks." (Source: AWS Security Hub User Guide - Managing Findings and Compliance) Why C is correct:
* Security Hub provides a centralized dashboard for compliance visibility.
* Conformance packs in AWS Config automate compliance checks across accounts.
* Fully managed, minimal maintenance, and integrates natively with AWS services.
Why others are incorrect:
* A: Conformance packs are not a feature of Amazon Inspector.
* B: Third-party tools on EC2 require management and add operational overhead.
* D: Systems Manager is not designed for compliance aggregation.
References:
AWS Security Hub User Guide - "Compliance Standards and Findings"
AWS Config User Guide - "Conformance Packs Overview"
AWS Well-Architected Framework - Security Pillar

The most cost-effective solution for serving video content with different bitrates is to store multiple versions of each video in Amazon S3. S3 provides scalable and cost-effective storage for large media files. Serving the videos from a single Amazon EC2 instance ensures low-latency delivery, and S3 storage helps minimize costs.
* Option A (ElastiCache): Caching large video files in memory would be prohibitively expensive and unnecessary.
* Option B (Auto Scaling group): Using Auto Scaling groups to serve video is less cost-effective compared to leveraging S3 for static storage.
* Option D (Kinesis Video Streams): Kinesis Video Streams is designed for real-time video streaming and is not suitable for storing and serving pre-recorded videos.
AWS References:
* Amazon S3 for Media Storage

This solution is the most cost-effective and efficient way to break down costs per application.
* Tagging Resources: By tagging all AWS resources with a specific key (e.g., "cost") and a value representing the application's name, you can easily identify and categorize costs associated with each application. This tagging strategy allows for granular tracking of costs within AWS.
* Activating Cost Allocation Tags: Once tags are applied to resources, you need to activate cost allocation tags in the AWS Billing and Cost Management console. This ensures that the costs associated with each tag are included in your billing reports and can be used for cost analysis.
* AWS Cost Explorer: Cost Explorer is a powerful tool that allows you to visualize, understand, and manage your AWS costs and usage over time. You can filter and group your cost data by the tags you' ve applied to resources, enabling you to easily see the cost breakdown for each application. Cost Explorer also supports generating regular reports, which can be scheduled and emailed to stakeholders.
* Why Not Other Options?:
* Option A (AWS Budgets): AWS Budgets is more focused on setting cost and usage thresholds and monitoring them, rather than providing detailed cost breakdowns by application.
* Option B (Load Cost and Usage Reports into RDS): This approach is less cost-effective and involves more operational overhead, as it requires setting up and maintaining an RDS instance and running SQL queries.
* Option D (AWS Billing and Cost Management Console): While you can download bills, this method is more manual and less dynamic compared to using Cost Explorer with activated tags.
AWS References:
* AWS Tagging Strategies - Overview of how to use tagging to organize and track AWS resources.
* AWS Cost Explorer - Details on how to use Cost Explorer to analyze costs.

Compute Savings Plans apply to EC2, AWS Fargate, and AWS Lambda usage, maximizing coverage for mixed architectures while retaining flexibility across instance families, regions, OS, and tenancy. For private connectivity, Lambda functions must be configured with VPC access to attach ENIs in the target subnets, enabling direct network access to EC2 in private subnets (no public subnets are required for intra-VPC communication). EC2 Instance Savings Plans only discount EC2 usage and are tied to a specific instance family in a region, reducing flexibility and leaving Lambda costs undiscounted. Keeping Lambda in the service VPC prevents direct access to private EC2 without VPC configuration. Thus, a 1-year Compute Savings Plan plus connecting Lambda to the private subnets minimizes total cost and meets connectivity needs.
References: AWS Savings Plans - Compute Savings Plans applicability (EC2, Fargate, Lambda); AWS Lambda Developer Guide - Configuring Lambda to access VPC resources (ENIs, subnets, security groups).