Creating a user pool in Amazon Cognito and configuring it for the application will meet the requirement of giving only a specific list of users the ability to access the application from the internet. A user pool is a directory of users that can sign in to an application with ausername and password1. The company can populate the user pool with the required users and configure the pool to require MFA for additional security2.
Configuring a listenerrule on the ALB to require authentication through the Amazon Cognito hosted UI will meet the requirement of not changing the application and not integrating it with an identity provider. The ALB can use Amazon Cognito as an authentication action to authenticate usersbefore forwarding requests to the Fargate service3. The Amazon Cognito hosted UI is a customizable web page that provides sign-in and sign-up functionality for users4.

AWS DataSync is an online data transfer service that is designed to help customers get their data to and from AWS quickly, easily, and securely. Using DataSync, you can copy data from your on-premises NFS or SMB shares directly to Amazon S3, Amazon EFS, or Amazon FSx for Windows File Server. DataSync uses a purpose-built, parallel transfer protocol for speeds up to 10x faster than open source tools. DataSync also has built-in verification of data both in flight and at rest, so you can be confident that your data was transferred successfully. DataSync allows you to apply filters to select which files or folders to transfer, based on file name, size, or modification time. You can also schedule your DataSync tasks to run daily, weekly, or monthly, or on demand. DataSync is integrated with AWS Direct Connect, so you can take advantage of your existing private connection to AWS. DataSync is also a fully managed service, so you do not need to provision, configure, or maintain any infrastructure for data transfer.
Option A is incorrect because the Amazon S3 CopyObject API operation does not support filtering or scheduling, and it would require you to write and maintain custom scripts to automate the backup process.
Option B is incorrect because AWS Backup does not support filtering or transferring data from on-premises sources to Amazon S3. AWS Backup is a fully managed backup service that makes it easy to centralize and automate the backup of data across AWS services.
Option D is incorrect because AWS Snowball Edge is a physical device that is used for offline data transfer when network bandwidth is limited or unavailable. It is not suitable for daily backups or incremental transfers.
AWS Snowball Edge also does not support filtering or scheduling.
1: Considering four different replication options for data in Amazon S3
2: Protect your file and backup archives using AWS DataSync and Amazon S3 Glacier
3: AWS DataSync FAQs

B is correct because ALB access logs contain the exact IP addresses of all incoming client requests, and storing these logs in S3 enables historical analysis. Using Amazon Athena to query them offers an efficient, serverless way to check when each IP last accessed the application.
D is correct because parsing ALB access logs gives direct evidence of activity from IP addresses - ideal for implementing the "last accessed in 90 days" rule.
A and C refer to VPC flow logs, which only capture network metadata, not HTTP request-level details like the ALB logs do.
E is incorrect - CloudTrail logs AWS API actions, not web requests through an ALB.
References:
Access logs for your Application Load Balancer
Querying ALB logs with Amazon Athena

Comprehensive and Detailed Explanation:
* A. Using AWS CloudFormation templates allows for the automaton of infrastructure deployment. By parameterizing the templates, resources can be provisioned consistently across multiple Regions, reducing administrative overhead and ensuring infrastructure as code practices.
* D. Amazon Route 53 latency-based routing directs user requess to the AWS Region that provides the lowest latency, improving access times for users globally and enhancing the user experience.
* E. Enabling DynamoDB Streams and adding a second Region to ceate a global table ensures that data is replicated across Regions, providing high availability and disaster recovery capabilities.
This combination of steps ensures that the application stack is replicated efficiently across Regions, providing disaster recovery, improved performance, and scalability, all while minimizing manual administrative tasks.
References:
AWS CloudFormation: Enables modeling and setting up AWS resources so that you can spend less time managing those resources and more time focusing on your applications.
Amazon Route 53 Latency-Based Routing: Helps improve performance for your global applications by serving user requests from the AWS Region that provides the lowest latency.
Amazon DynamoDB Global Tables: Provides a fully managed, multi-Region, and multi-active database that delivers fast and local read and write performance for massively scaled, global applications.

B is correct becauseAWS/Usagenamespace in CloudWatch provides built-in metrics for service quota usage.
You can create an alarm forFargate task count usageand notify the dev team usingSNSwhen it reaches 80% of the quota.
* A misuses "Sample Count" and doesn't relate to service quota.
* C is overly complex and not needed - native metrics exist.
* D misuses Config (meant for compliance, not utilization).
Reference:https://docs.aws.amazon.com/servicequotas/latest/userguide/monitoring-using-cloudwatch.html