Data Replication for Block Storage is the correct feature. It provides synchronous replication of block storage volumes across multiple availability zones within a region, ensuring a Recovery Point Objective (RPO) of zero (no data loss) and a fast Recovery Time Objective (RTO) in case of a zone failure. This is the specific solution designed for high-availability and disaster recovery scenarios with minimal data loss, unlike snapshots (which are point-in-time copies) or tier selections (which focus on performance/cost).

Stopping the instances is the most direct and cost-effective solution here. For Virtual Servers for VPC, you are only charged for provisioned storage and any floating IPs while the instance is stopped; the vCPU and RAM charges cease. This is ideal for non-production, development, or intermittently used workloads that can tolerate a restart. Resizing (A) changes configuration, Code Engine (B) is a different service model, and Reserved Instances (D) commits to a running instance for a term, which doesn’t solve the low-utilization issue.

A Public Gateway (PGW) is the correct service. It allows resources with no floating IP (like worker nodes in a private-only cluster) to initiate outbound connections to the public internet, which is exactly what’s needed to pull images from a public registry. It does not allow unsolicited inbound connections, maintaining the security posture. CIS is for protecting/public-facing inbound traffic, VPN is for site-to-site connectivity, and Transit Gateway is for connecting VPCs and networks.

The description perfectly matches the IBM Cloud Security and Compliance Center. It is specifically designed for centralized security posture management, allowing you to define compliance profiles (like NIST, ISO), collect evidence from your cloud resources, and view a dashboard of your compliance status against those controls. IAM manages access, Activity Tracker logs events, and Hyper Protect Crypto Services focuses on encryption and key management.

While all options offer some form of scaling, Virtual Server Instances with auto-scaling is the most direct and best fit for this scenario describing an existing monolithic web application on a virtual server. The instance group auto-scaling feature for VPC VSIs can monitor CPU and scale the number of identical virtual servers in a group up and down based on defined policies. This allows the application architecture to remain largely unchanged while gaining elasticity. Code Engine and Kubernetes involve re-architecting to containers, and Functions is for event-driven code snippets.

IBM Cloud Monitoring (powered by Sysdig) is the centralized platform for metric-based alerting across IBM Cloud services, including IBM Cloud Databases. Platform metrics like connection count and disk utilization are automatically collected. You would create alerting policies in Monitoring to define the thresholds (80%, 85%) and notification channels. The Databases settings page manages the service, not granular alerts. Database config files don’t handle IBM Cloud alerts, and LogDNA is for logs, not real-time metrics.

Immutable Object Storage is the specific feature designed for Write-Once-Read-Many (WORM) compliance. When enabled with a retention period (e.g., 90 days), it legally prevents objects from being deleted or modified until the hold expires. Object Versioning keeps older versions but doesn’t prevent deletion of the latest version or the versions themselves. Archive Tier is a storage class for cold data. Lifecycle Rules automate transitions/deletions but do not enforce immutability.

This combination represents a fully serverless, managed architecture. App ID provides managed authentication. IBM Cloud Functions executes API logic in a serverless, event-driven manner (e.g., triggered by an HTTP request). Cloud Object Storage is the managed, scalable service for storing unstructured data like photos. Databases for PostgreSQL is a fully managed database for structured metadata. This entire stack requires no provisioning or management of servers, clusters, or storage hardware, allowing the team to focus solely on code.

Under the shared responsibility model, IBM Cloud is responsible for the security *of* the cloud. This includes the physical infrastructure, global network, hypervisors for compute, and the underlying software-defined layers of managed services (like the database engine for IBM Cloud Databases). Patching the hypervisor and physical infrastructure falls squarely under this. The customer is responsible for security *in* the cloud: configuring guest OS firewalls (A), applying data encryption (C), and managing access (D).

Data Replication for Block Storage is the correct feature. It provides synchronous replication of block storage volumes across multiple availability zones within a region, ensuring a Recovery Point Objective (RPO) of zero (no data loss) and a fast Recovery Time Objective (RTO) in case of a zone failure. This is the specific solution designed for high-availability and disaster recovery scenarios with minimal data loss, unlike snapshots (which are point-in-time copies) or tier selections (which focus on performance/cost).0