An e-commerce team misses overnight checkout failures because CloudWatch metrics sit unwatched and on-call learns from customers. They need immediate paging, ticket context, and one-click remediation for known faults. Which alerting design provides timely detection with automated response?

CloudWatch alarms replace unwatched metrics with threshold-based detection, and SNS can deliver the alert to on-call while also triggering Systems Manager Automation. Approved, auditable runbooks provide a controlled way to remediate known checkout faults, closing the loop from detection to action without waiting for customers to report failures. The design that opens ServiceNow tickets and triggers Automation supports record-keeping and repeatable recovery, but it does not page on-call, so an overnight failure may wait for triage. The design that pages and opens detailed incident tickets improves notification and context, but it has no automated remediation; known faults still require manual diagnosis and recovery. The design that pages and triggers Lambda can respond quickly to transient faults, but it substitutes custom function-based restarts for curated, versioned Automation runbooks with approved execution, weakening operator control and auditability for known faults. An exam caveat is to distinguish notification from remediation and check which outcomes the selected design actually provides; ticketing alone is not paging, and paging alone is not recovery. A practical check is to fire a test alarm in non-production and verify that the page arrives within the SLO and the Automation execution completes with its approvals, logs, and rollback status. The listed correct design does not itself open an incident ticket, so verify separately whether ticket context is required.