Amazon EBS encryption is the right choice because it encrypts data at rest for EBS-backed storage by using AWS KMS and does so transparently. AWS documentation states that encrypted EBS volumes provide thesame IOPS performance as unencrypted volumes, with only a minimal effect on latency, which fits the requirement to avoid meaningful performance impact. Writing to S3 changes the storage architecture. A custom encryption algorithm would add development and operational complexity. Encrypting only the AMI root volume does not ensure the attached application data volumes are protected, and ephemeral disks are not the intended persistent storage here. Therefore, usingencrypted EBS volumesis the simplest and correct solution. (AWS Documentation)

Amazon DocumentDB global clusters support managed cross-region failover, allowing you to promote a secondary region to become the new primary with minimal downtime. This ensures business continuity during maintenance or regional disruptions.
Reference Extract:
"Amazon DocumentDB global clusters support managed cross-Region failover, allowing you to recover quickly from regional disruptions with minimal downtime." Source: AWS Certified Solutions Architect - Official Study Guide, DocumentDB and Resiliency section.

AWS Secrets Manager is the recommended service for storing database credentials and performing automated rotation. Any Lambda function version or alias can fetch the latest secret value at runtime, ensuring no outdated credentials exist in deployed versions.
Environment variables (Option C) are static per version. Embedding credentials in code (Option B) is insecure and requires redeployment. Parameter Store (Option D) supports rotation but requires more configuration and is not as seamless as Secrets Manager for database credential rotation.

AWS Fargate runs containers without managing servers, and ECS Service Auto Scaling adjusts the number of tasks based on demand. Behind an Application Load Balancer, ECS services elastically scale out to handle concurrent long-running requests. This fits workloads with processing times of 5-20 minutes per request.
Lambda (C, D) has a maximum 15-minute timeout, so a portion of requests would fail or require complex refactoring and orchestration. Option B relies on vertical scaling and manual intervention, leaving capacity idle and failing to scale automatically with spikes. By containerizing the app and running on ECS with Fargate, the company gains automatic scaling, isolation per task, and no instance management, ensuring reliable throughput as request volume grows while keeping operations minimal.

When operating in disconnected or limited-connectivity environments, such as ships at sea, AWS recommends using AWS Snowball Edge devices to host local compute and storage workloads. Snowball Edge supports Amazon EC2 instances and AWS IoT Greengrass, and can run Amazon EKS Anywhere for local Kubernetes cluster deployments.
From AWS Documentation:
"You can use AWS Snowball Edge devices to run compute-intensive applications in remote or disconnected locations. Snowball Edge devices support running Amazon EC2 instances and Amazon EKS Anywhere clusters." (Source: AWS Snow Family - Developer Guide) Why A is correct:
Snowball Edge provides local compute and storage even without internet connectivity.
Multiple Snowball Edge devices can be clustered together for high availability and failover.
Fully self-contained environment suitable for ships or field operations.
Why the others are incorrect:
B, C, D require network connectivity to AWS Regions or Zones (Local Zone, Outposts, Wavelength), which is not available at sea. These options cannot operate fully disconnected.
References:
AWS Snow Family Developer Guide - "Running Compute Applications on AWS Snowball Edge" AWS Well-Architected Framework - Resilience Pillar AWS Architecture Blog - "Edge Computing with Snow Family"