The web server access log shows a GET request from 104.210.233.225 to the path
"/../../../../conf/server.xml", which indicates a directory traversal attack. This type of attack allows an attacker to access sensitive files outside the intended directory structure, in this case, the server.xml configuration file, which may contain sensitive information such as credentials or system configurations.
The web application firewall (WAF) log does not show any specific blocking actions, suggesting that the attack was successful in retrieving and potentially exfiltrating sensitive data from the corporate web server.

The web application not responding after DNS updates often indicates a misconfiguration, such as the web server not correctly pointing to the migrated database location. Verifying this ensures proper connectivity between the application and database.

For subnets within a VPC to communicate, the routing tables must contain the appropriate routes.
Since the existing subnets can already reach each other and only the newly created private subnet is unreachable, the most likely cause is that the subnet is not associated with the correct route table or is missing the necessary route entries to enable communication with the other subnets.

A multi-availability zone database instance provides automatic failover across data centers and supports point-in-time recovery, meeting both the high-availability and restoration requirements.

Configuring scaling for the seasonal sales period allows resources to automatically adjust to demand, ensuring performance while minimizing cost compared to permanently adding or pre- deploying extra resources.