Field-level encryption in Amazon CloudFront provides end-to-end encryption for specific data fields (e.g., credit card numbers, social security numbers). It ensures that sensitive fields are encrypted at the edge before being forwarded to the origin, and only the authorized application with the private key can decrypt them.
This adds a layer of protection beyond HTTPS, which encrypts the whole payload but not individual fields.
Signed URLs and cookies are for access control, not encryption. Setting HTTPS Only is a good practice but does not satisfy the field-specific encryption requirement.

For latency-sensitive, globally distributed applications such as online gaming, minimizing network latency between users and application endpoints is critical. AWS Global Accelerator is designed specifically for this purpose. It uses the AWS global network and Anycast IP addresses to route user traffic to the closest healthy endpoint, reducing latency and improving performance for users worldwide.
Option C is the best solution because Global Accelerator directs traffic over the AWS backbone network instead of the public internet, which significantly reduces jitter and latency. It also provides built-in health checks and automatic failover, improving availability as the service expands globally. Importantly, Global Accelerator works seamlessly with existing Application Load Balancers, allowing the company to enhance performance without redesigning the application stack.
Option A (CloudFront) is optimized for caching static and cacheable content and is not ideal for real-time, stateful gaming traffic. Option B adds unnecessary API abstraction and additional latency. Option D introduces regional duplication and DNS-based routing, which is slower to react to network conditions and does not provide the same low-latency routing as Global Accelerator.
Therefore, C meets the requirement for global expansion with the least possible latency while maintaining a simple and highly performant architecture.

Comprehensive and Detailed 250 to 300 words of Explanation (AWS documentation-based, no links):
The key constraint is no application code changes, while the observed failure mode during spikes is heavy write load on the database that makes the site unresponsive. Scaling the web tier alone (Option B) may not help if the database is the bottleneck; in fact, adding more EC2 instances can increase concurrent write pressure and worsen the database overload. Caching (Option A) would require modifying the application to use Redis for query caching, which violates the no-code-change requirement. Option C is not a fit:
CloudFront caching is effective for cacheable content, but authenticated, personalized pages are typically not cacheable without application changes, and "write throttle" is not a standard CloudFront feature to protect the database.
Migrating from RDS for MySQL to Amazon Aurora Serverless is a managed approach designed to automatically adjust database capacity to match workload demand, which is well suited to "low baseline traffic with occasional sudden spikes." By setting an appropriate maximum capacity, Aurora Serverless can scale to handle bursts more gracefully than a fixed-size RDS instance, improving availability during unpredictable demand. This reduces operational overhead because capacity management is largely handled by the service rather than by manual instance resizing or complex scaling scripts.
The final step-configuring EC2 instances to connect to the new Aurora endpoint-is an infrastructure configuration change, not an application code rewrite. The application continues to speak the same MySQL- compatible protocol (Aurora MySQL-compatible), preserving compatibility while improving resilience to spikes.
Therefore, D best meets the requirement to improve availability during sudden traffic increases driven by heavy database writes, with minimal operational effort and no application code changes.

AWS guidance is to cover steady baseline with commitments (Reserved Instances or Savings Plans) and use EC2 Spot Instances for burst capacity to minimize cost. Spot provides up to 90% discounts and is well-suited to fault-tolerant, queue-based workloads; interruptions are handled by replacing capacity automatically while messages remain durably in SQS. Using only Spot (A) risks capacity gaps; only RIs sized for peak (B) wastes cost during low demand. Option D scales on backlog but uses On-Demand for bursts, which is more expensive than Spot. With C, baseline capacity (RIs) keeps processing continuously (no downtime), and Spot adds cost-efficient throughput during spikes, aligning with Well-Architected cost and reliability patterns for queue workers.
References: EC2 Spot Best Practices - burst with Spot for interruptible/queued workloads; SQS - durable buffering; Well-Architected Cost Optimization - cover steady state with commitments, scale bursts with discounted capacity.

* AWS Direct Connect: Provides a dedicated network connection from your on-premises data center to AWS, ensuring low latency and consistent network performance.
* Direct Connect Gateway Association:
* Direct Connect Gateway: Acts as a global network transit hub to connect VPCs across different AWS regions.
* Association with Transit Gateway: Enables communication between on-premises data centers and multiple VPCs connected to the transit gateway.
* Transit Virtual Interface (VIF):
* Create Transit VIF: To connect Direct Connect with a transit gateway.
* Setup Steps:
* Establish a Direct Connect connection.
* Create a transit VIF to the Direct Connect gateway.
* Associate the Direct Connect gateway with the transit gateway attached to the VPCs.
* Cost Efficiency: This combination avoids the recurring costs and potential performance variability of VPN connections, providing a robust, low-latency hybrid network solution.
References:
* AWS Direct Connect
* Transit Gateway and Direct Connect Gateway