https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.
html#orgs_manage_accounts_access-cross-account-role "When you create a member account using the AWS Organizations console, AWS Organizations automatically creates an IAM role named OrganizationAccountAccessRole in the account" you need OrganizationAccountAccessRole in member account to create an read-only role and use role from security team to assume this read-only role.

* B: Outbound Resolver endpoints enable EC2 instances tosendDNS queries to external resolvers (i.e., on-prem DNS servers).
* C: A forwarding rule must be created to forward the internal.company.com domain to the on-prem resolver.
* E: You must associate the rule withevery VPCthat needs to forward the queries.
Incorrect:
* A: Inbound endpoints are forreceivingDNS queries from on-prem to AWS, not vice versa.
* D: There's no such thing as a "System" rule type.
* F: Limiting to one VPC won't meet the requirement.
Reference:#https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html

https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-cost-categories.html
https://aws.amazon.com/premiumsupport/knowledge-center/cost-explorer-analyze-spending-and-usage/
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-cost-categories.html https://docs.aws.
amazon.com/cost-management/latest/userguide/ce-enable.html
The best combination of actions to meet the company's requirements is Options A, C, and F.
Option A involves activating the user-defined cost allocation tags that represent the application and the team.
This will allow the company to assign costs to different applications or teams, and will allow them to be tracked in the monthly AWS bill.
Option C involves creating a cost category for each application in Billing and Cost Management. This will allow the company to easily identify and compare costs across different applications and teams.
Option F involves enabling Cost Explorer. This will allow the company to view the costs of their AWS resources over the last 12 months and to create forecasts for the next 12 months.
These recommendations are in line with the official Amazon Textbook and Resources for the AWS Certified Solutions Architect - Professional certification. In particular, the book states that "You can use cost allocation tags to group your costs by application, team, or other categories" (Source: https://d1.awsstatic.com/training- and-certification/docs-sa-pro/AWS_Certified_Solutions_Architect_Professional_Exam_Guide_EN_v1.5.pdf).
Additionally, the book states that "Cost Explorer enables you to view the costs of your AWS resources over the last 12 months and to create forecasts for the next 12 months" (Source: https://d1.awsstatic.com/training- and-certification/docs-sa-pro/AWS_Certified_Solutions_Architect_Professional_Exam_Guide_EN_v1.5.pdf).

Comprehensive and Detailed Explanation:
C is correct:AWS Compute Optimizeruses machine learning to analyze usage patterns and recommends rightsizing.Trusted Advisoradds further insights. Combining these withSavings Plansgives the best cost optimizationwithout reducing availability.
* A is risky due to using Lambda for termination.
* B and D offer partial or manual solutions.
#Reference:AWS Compute Optimizer

The company wants to serve static content from an S3 bucket during the maintenance period. To do this, the following steps are required:
* Upload static informational content to the S3 bucket. This will provide the source of the content that will be served to the visitors.
* Set the S3 bucket as a second origin in the original CloudFront distribution. Configure the distribution and the S3 bucket to use an origin access identity (OAI). This will allow CloudFront to access the S3 bucket securely and prevent public access to the bucket.
* During the weekly maintenance, edit the default cache behavior to use the S3 origin. Revert the change when the maintenance is complete. This will redirect all web requests to the S3 bucket instead of the Elastic Beanstalk domain name.
The other options are not correct because:
* Creating a new CloudFront distribution is not necessary and would require changing the alternate domain name configuration.
* Creating a cache behavior for the S3 origin on a new distribution would not work because the visitors would still access the original distribution using the alternate domain name.
* Configuring Elastic Beanstalk to serve traffic from the S3 bucket is not possible and would not achieve the desired result.
References:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide
/DownloadDistS3AndCustomOrigins.html
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to- s3.html
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.
html#DownloadDistValuesPathPattern