AWS provides EBS Block Public Access at the AWS Organizations level, which, when enabled, prevents EBS snapshots from being shared publicly across all member accounts. This is an organization-wide control that requires minimal configuration and no ongoing monitoring to prevent public sharing.
This directly satisfies the requirement:
* Covers all accounts managed by Organizations.
* Explicitly prevents public snapshot sharing.
* Has the least operational overhead because it is a single centralized control.
AWS Config (Option A) only monitors and alerts, but does not prevent public sharing.
An IAM policy in the root account (Option C) is harder to enforce consistently across all accounts and may not cover all permission paths.
CloudTrail (Option D) only logs events and does not prevent public access.

To improve the performance of the primary RDS PostgreSQL database during business hours and reduce the load, the best solution is to create a read replica in the same region (us-east-1). This will offload the read- heavy operations (like generating reports) to the replica, reducing the burden on the primary instance, which improves overall performance. Additionally, read replicas provide near real-time replication, making them ideal for real-time reporting use cases.
* Option A (cross-Region read replica): This adds unnecessary latency for real-time reporting and increased costs due to cross-region data transfer.
* Option B (Multi-AZ): Multi-AZ deployments are for high availability and disaster recovery but won't offload the read traffic, as the standby database cannot serve read requests.
* Option C (AWS DMS replication): This adds complexity and is not as cost-effective as using an RDS read replica for the same region.
AWS References:
* Amazon RDS Read Replicas
* Amazon RDS Performance Best Practices

AWS CloudFormation allows for the automated, repeatable setup of infrastructure, reducing human error and ensuring consistency. AWS Config provides the ability to track changes in the infrastructure, ensuring that all changes are logged and auditable, which satisfies the requirement for tracking incremental changes.
* Option A and C (AWS Organizations): AWS Organizations manage multiple accounts, but they are not designed for infrastructure setup or change tracking.
* Option D (Service Catalog): Service Catalog is used for deploying products, not for setting up infrastructure or tracking changes.
AWS References:
* AWS Config
* AWS CloudFormation

Amazon EBS Snapshots Recycle Bin enables you to specify retention rules for EBS snapshots based on tags.
When snapshots are deleted, they are retained in the Recycle Bin for a specified duration, preventing accidental deletion. Tag-level rules allow selective protection without changing IAM roles or user permissions.
Reference: AWS Documentation - Amazon EBS Snapshots and Recycle Bin

A mix of On-Demand Instances and Spot Instances is the best cost-optimized option when the company wants lower cost but does not want long-term commitments. On-Demand Instances provide baseline reliability and require no upfront payment or term commitment. Spot Instances can significantly reduce compute cost for flexible portions of the Auto Scaling group, as long as the application can tolerate replacement capacity when Spot capacity is interrupted. Reserved Instances require a commitment, so options B and D violate the requirement. Dedicated Instances are generally used for compliance or isolation requirements and do not optimize cost for a scalable web application. Auto Scaling groups can use multiple purchasing options to balance availability and cost.