A healthcare SaaS stores PHI in S3 and shares analytics via cross-account roles, but auditors found a VPC endpoint allowed S3 access from outside the organization and external principals accessed a bucket. Strict data perimeter and least privilege are required. Which data perimeter design validates external access and restricts egress?

The correct design works because it layers detective validation with preventive identity and network perimeters required for PHI and least privilege, with Access Analyzer identifying unintended external access, SCPs enforcing an organization-wide boundary on principals and resources, and VPC endpoint policies restricting egress to trusted buckets and principals. The SCP with external ID and MFA approach improves cross-account authentication and org-level denial but fails network containment because it leaves the VPC endpoint permissive and still allows requests to untrusted buckets from inside the VPC. The VPC endpoint plus bucket policy approach restricts network paths and resource access effectively but fails identity-scale enforcement because without centralized SCPs and continuous Analyzer validation new roles can still grant untrusted external principals access. The Analyzer with CloudTrail Lake and rotation approach strengthens auditing and credential hygiene but fails prevention because detective findings and scheduled rotation do not block impermissible egress or enforce trusted principal and resource conditions at request time. On exams distinguish monitoring from blocking and require trusted principal, trusted resource, and expected network together; in practice test with untrusted principal, bucket, and network simulations and confirm explicit denies plus zero active Analyzer external findings.