For a tightly coupled, legacy application with synchronous dependencies, a rehosting (lift-and-shift) strategy is often the most practical first step. It minimizes initial disruption and complexity by moving the existing architecture as-is. More transformative strategies like refactoring or rebuilding, while potentially offering long-term benefits, carry significantly higher risk, cost, and time requirements for such an application and are not the best ‘initial’ approach.

The core issue is the use of a default, well-known credential on a new resource. This is a failure in establishing a secure initial baseline configuration, which should mandate changing default passwords, disabling unnecessary services, and applying security patches before a system is deployed, especially in a cloud environment. While firewall policies (option D) are related, the primary vulnerability is the weak baseline config itself.

Auto-scaling groups often have a cooldown period—a configurable wait time after a scaling activity before another can be initiated. If this period is set too long, it can prevent the system from responding quickly to rapid, sustained traffic increases. Investigating and potentially adjusting this cooldown period is a key troubleshooting step for performance issues during variable load, making it the most likely first factor to check.

This option provides the strongest end-to-end security control aligned with stringent regulatory needs. IPsec VPN ensures encrypted transit over potentially untrusted networks. Client-side encryption with customer-managed keys (CMK) means data is encrypted before it ever reaches the CSP’s storage, and the customer retains full control over the encryption keys, providing the highest level of security and compliance for data at rest. Option A uses CSP-managed keys, which offers less control.

A warm standby strategy involves having a scaled-down but fully functional version of the environment always running in a secondary location. It allows for recovery within a few hours (meeting the 4-hour RTO) and uses frequent data replication (e.g., every 5-15 minutes) to meet the 15-minute RPO. Pilot light (B) has a longer RTO, active-active (D) has near-zero RTO/RPO but is more costly, and backup/restore (A) has the longest RTO/RPO.

The most effective and proactive way to prevent configuration drift is to enforce immutability for resources managed by IaC. Using cloud-native governance tools (like AWS Service Control Policies, Azure Policy, or GCP Organization Policies) to explicitly deny modification or deletion actions outside of the approved IaC pipeline ensures that the deployed state always matches the source code, eliminating drift at its root cause.

When containers on new hosts cannot pull images from a private repository, the most common cause is a lack of authentication credentials. The host’s container runtime (like Docker or containerd) needs to be configured with the proper credentials (e.g., via a secrets object in Kubernetes or an instance profile in AWS) to authenticate to the private registry. Incorrect tags (C) would fail everywhere, not just on new hosts.

Identifying and removing orphaned or idle resources like old snapshots and unattached IP addresses is a direct action under the ‘Eliminate Waste’ pillar of cloud cost optimization. This pillar focuses on turning off what you don’t need. Right-sizing (A) is about matching instance types to workload requirements, and Reserved Instances (B) is about committing for discounts on needed resources.

Federating access using an existing identity provider (like SAML or OIDC) is a secure best practice that avoids creating permanent credentials. It allows the auditors to use their own corporate logins. This access can be configured to be time-bound through role session durations or conditional policies, providing the required temporary access with minimal manual user lifecycle management and no password/key sharing.

For a tightly coupled, legacy application with synchronous dependencies, a rehosting (lift-and-shift) strategy is often the most practical first step. It minimizes initial disruption and complexity by moving the existing architecture as-is. More transformative strategies like refactoring or rebuilding, while potentially offering long-term benefits, carry significantly higher risk, cost, and time requirements for such an application and are not the best ‘initial’ approach.0