Amazon S3 presigned URLs are the most secure fit because they providetime-limited access to specific objectswithout requiring the external vendor to have AWS credentials or direct bucket permissions. AWS documentation states that presigned URLs grant temporary access to private S3 objects and can be used for downloads through a browser or program. This is stronger than creating an IAM user or sharing temporary keys because those methods still expose AWS credentials to a third party. A bucket policy based only on source IP is broader and less precise than object-level, time-bounded access. Presigned URLs let the company control exactlywhich objectcan be downloaded andfor how long, which is exactly what the scenario requires.
(AWS Documentation)

The correct answer isBbecause the company wantshigh availability,minimum downtime,minimum data loss, and theleast operational effort. For the application tier, configuring the Auto Scaling group to spanmultiple Availability Zonesincreases resilience by ensuring that the loss of one Availability Zone does not make the application unavailable. Since the application is already behind an Application Load Balancer, traffic can continue to be routed to healthy instances in other Availability Zones.
For the database tier, the single-AZ Aurora PostgreSQL deployment represents a single point of failure.
Configuring the database forMulti-AZimproves availability and durability by maintaining a synchronized standby in another Availability Zone and supporting failover with minimal disruption. This approach is aligned with AWS best practices for relational database high availability.
UsingAmazon RDS Proxyfurther improves availability at the application layer by managing database connections efficiently and helping applications reconnect more quickly during failover events. This reduces the operational complexity of handling transient database interruptions and can improve application resilience.
Option A introduces multi-Region complexity, which is not required to meet the stated need and creates more operational overhead. Option C does not provide high availability because snapshots are a backup and restore mechanism, not an automatic failover solution, and hourly snapshots can result in significant data loss. Option D is unnecessarily complex and changes the application data flow in a way that is not needed.
The simplest and most AWS-aligned solution is to make both the compute and database layers highly available acrossmultiple Availability Zones. That provides resilience with the least operational burden.

The best answer is to enableS3 Block Public Access at the account leveland back it with theAWS Config s3- account-level-public-access-blocks ruleplus automated remediation. AWS states that S3 Block Public Access can be applied at the account level and overrides public bucket policies and ACLs so you can centrally prevent public access across the account. AWS Config provides a managed rule specifically for checking those account-level settings, and AWS Systems Manager includes an automation runbook to remediate drift.
This is stronger and more scalable than relying on detection tools alone, because it both prevents exposure and automatically restores compliance if settings change. (AWS Documentation)

AWS Global Accelerator is a service that improves global application availability and performance using the AWS global network. It supports both TCP and UDP protocols and provides optimized routing and lower latency for real-time applications such as VoIP, regardless of where the user is located globally.
AWS Documentation Extract:
"AWS Global Accelerator uses the AWS global network to optimize the path to your application endpoints, improving performance for TCP and UDP traffic, such as VoIP." (Source: AWS Global Accelerator documentation) B: CloudFront accelerates HTTP/S content, not TCP/UDP.
C: Route 53 geoproximity routing is for DNS-based routing, not for traffic acceleration.
D: Network Load Balancers support TCP/UDP, but do not address global latency or provide acceleration.
Reference: AWS Certified Solutions Architect - Official Study Guide, Networking Optimization.

Amazon SQS supports Interface VPC endpoints (AWS PrivateLink), enabling private connectivity from your VPC to SQS without using public IPs, traversing the public Internet, or requiring NAT/IGW. You can restrict access by attaching a queue resource policy that allows only the specific VPC endpoint and denies all other principals/paths, enforcing that all traffic stays on the AWS network. SSE-SQS (B) encrypts data at rest but does not influence network pathing. STS temporary credentials (C) handle authentication/authorization, not routing. VPC Flow Logs (D) are monitoring/visibility and do not prevent public egress. Creating an SQS VPC endpoint and tightening the queue policy satisfies the requirement of no public IP usage while maintaining secure, private access from serverless components in VPC subnets.
References: Amazon SQS - VPC endpoints (PrivateLink) and endpoint policies; Amazon SQS queue policies and condition keys; Security best practices for private access.