A logistics company is migrating 200 EC2 instances, serverless APIs, and Aurora databases to AWS, and needs to define what to monitor for security, including authentication failures, privilege use, and data access anomalies across all layers. Budgets are limited. Which approach best analyzes workloads to determine monitoring requirements for alerting design?

The correct approach works because risk-based inventory of critical assets, data flows, and threats defines monitoring before alert design, translating authentication failures, privilege use, and data-access anomalies across EC2, serverless APIs, and Aurora into required log sources, metrics, and thresholds prioritized by risk while respecting limited budgets. Centralized logging with CloudTrail, VPC flow, and Aurora events using default severities fails by default substitution: it aggregates well but replaces workload-specific analysis with vendor defaults, so thresholds are not risk-derived and privilege misuse or nuanced anomalies cause noise or gaps. Host-and-database inventory for EC2 OS metrics and Aurora audit logs fails by incomplete scoping: it applies valid host and database practice yet omits serverless APIs and functions, leaving that layer's authentication and data-access paths unaddressed. Full-fidelity telemetry everywhere with long retention for forensics fails by unconstrained maximization: it aids visibility and investigation but ignores budget limits and prioritization, creating unsustainable ingestion, storage, and triage cost. On the exam, distinguish analyze-to-determine-requirements stems from implement-collection stems, favoring risk-driven scoping over enable-everything breadth. In practice, list crown-jewel assets and abuse cases for login, privilege escalation, and abnormal reads, then trace each to the minimal log, metric, and threshold that detects it and confirm per-layer coverage within cost.