A logistics company documented a ransomware containment runbook for EBS-backed fleets but has never executed it, and leaders doubt backup restores and IAM lockdown steps work under stress. The team needs controlled failure drills with measured recovery. Which testing control validates the response plan under realistic failure?

The correct control succeeds because AWS Fault Injection Service delivers controlled failure drills with safety guardrails and measured outcomes, injecting a realistic failure (such as an AZ power interruption or paused EBS I/O) while the team executes its containment, IAM lockdown, and EBS restore runbook under pressure; FIS creates the stress and stop conditions, and the team performs the response steps, rather than assuming the untested runbook works. Validating snapshot restores and IAM policies in an isolated test account is common for proving backup integrity yet fails as validation because calm-condition restores do not rehearse detection, containment coordination, and time-pressured execution that leaders question. Assessing the workload with AWS Resilience Hub is best practice for policy alignment and recommendations yet fails by scope because analysis without injected failure never exercises people, runbook handoffs, or recovery timing. Scheduling automated restoration checks with CloudWatch timing is effective for tracking recovery objectives yet fails by completeness because it measures only volume recovery while omitting containment and lockdown orchestration. An exam caveat is to separate controls that test operability under failure from controls that improve detectability, durability, or design scores, since only executed drills prove the plan works under stress. A practical check is to run the scenario against a staged fleet replica with hypothesis, abort criteria, and timers for containment and full restore, then retain logs and metrics as evidence for leadership review.