Service control policies (SCPs) in AWS Organizations apply to the accounts or OUs to which they are attached:
* To restrict only nonproduction accounts, you can:
* Attach the SCP directly to those specific member accounts (Option B), or
* Create a dedicated OU for the nonproduction accounts and attach the SCP to that OU (Option E).
Both methods ensure that the deny policy affects only the nonproduction accounts and does not impact the production account.
Why the others are incorrect:
* A: Attaching the SCP to the root OU would apply the deny to all accounts, including production, which does not meet the requirement.
* C: SCPs attached to the management account only affect that account, not all member accounts.
* D: Creating an OU for the production account and attaching the deny SCP there would block the prohibited instance types in production, which is the opposite of what is required.

Amazon Route 53 health checks can automatically perform DNS failover to healthy endpoints. When integrated with an Application Load Balancer, this provides a highly resilient system architecture that automatically routes traffic to healthy resources across Regions or endpoints.
From AWS Documentation:
"Route 53 DNS failover automatically routes traffic away from unhealthy resources and directs it to healthy resources that you specify in DNS records." (Source: Amazon Route 53 Developer Guide - DNS Failover) Why B is correct:
Route 53 health checks automatically monitor endpoint health and switch to a healthy target when the primary endpoint fails.
The failover process is automatic, with no manual updates to DNS records required.
Combined with ALB's built-in multi-AZ resilience, this provides maximum availability.
Why others are incorrect:
A & C: Require manual DNS updates, which are not automatic and introduce latency.
D: Creating new ALBs during failover increases downtime and is operationally inefficient.
References:
Amazon Route 53 Developer Guide - "Configuring DNS Failover"
AWS Well-Architected Framework - Reliability Pillar

EC2 Instance Connect Endpoint is the correct answer because it allows secure SSH access to private EC2 instances without public IP addresses, bastion hosts, NAT gateways, or inbound internet access.
This directly satisfies the company's restrictions and supports cost reduction by allowing the NAT gateways to be decommissioned if they are only used for this troubleshooting access pattern. Session Manager is not valid because the company does not support installing agents, and Session Manager requires the SSM Agent and Systems Manager connectivity. Bastion hosts require additional EC2 infrastructure and inbound access controls. Client VPN adds VPN management and does not remove the need for routing design across all VPCs as cleanly as EC2 Instance Connect Endpoint.

A DynamoDB gateway VPC endpoint is the most secure and cost-effective option because it allows private access from the VPC to DynamoDB without requiring an internet gateway, NAT gateway, or public IP path. Gateway endpoints for DynamoDB use route table entries to direct traffic to the DynamoDB prefix list over the AWS network. Endpoint policies can further restrict access to only the required DynamoDB tables, which supports least privilege. Interface endpoints are available for DynamoDB, but they add hourly and data processing charges, so they are not the most cost-effective choice when a gateway endpoint satisfies the requirement. VPC peering is not valid because DynamoDB is an AWS managed service, not a customer VPC that can be peered.

To grant the ECS application the least privilege, you create an IAM policy that explicitly lists the ARNs of the specific S3 buckets the task should access. You then attach this policy to the task role (not the instance role), ensuring only that task has the necessary permissions. This approach avoids granting permissions to other EC2 instances or services and restricts access strictly to the required buckets.
AWS Documentation Extract:
"Attach an IAM policy granting access to specific resources to the ECS task role, not to the instance role, to ensure that only the container has access according to the principle of least privilege."
"Use explicit ARNs to control access only to specified S3 buckets."
(Source: Amazon ECS documentation, IAM Roles for Tasks)
A: Tag-based access control for S3 buckets is possible but less direct and commonly used for identity-based access.
C: Attaching the policy to the instance role could grant unintended permissions to all containers or services running on the instance.
D: Wildcard ARNs grant broader access than necessary.
Reference: AWS Certified Solutions Architect - Official Study Guide, IAM Best Practices.