An architecture team wants a structured review of a cloud workload's design against defined pillars, including security, reliability, performance efficiency and cost optimization, producing a list of risks and recommended improvements. Which approach best fits?
Select an answer to reveal the explanation.
Short Explanation
It's like a home inspection with a checklist for the roof, wiring and plumbing, room by room. A Well-Architected review walks your workload through each pillar and hands you a fix list. The trap is the penetration test, which pokes at the doors but doesn't review the design.
Full Explanation
A Well-Architected Framework review evaluates a workload against a set of pillars, commonly including operational excellence, security, reliability, performance efficiency and cost optimization, using structured questions and best practices. The output is a list of identified risks and prioritized improvements, which is exactly what the team wants. The outline lists the Well-Architected Framework among cloud design patterns, and the concept is used across providers in a vendor-neutral sense. A SOC 2 Type II examination is an independent attestation of a service organization's controls over a period; it assures customers about a provider rather than reviewing the design of the customer's own workload. A penetration test actively attempts to exploit vulnerabilities in exposed endpoints; it finds exploitable weaknesses but does not assess reliability, performance or cost, nor review design choices systematically. A business impact analysis determines criticality and recovery objectives for business processes; it informs continuity planning, not a pillar-by-pillar design review. Exam caveat: a Well-Architected review is a design assessment, not an audit or certification, so its results are not evidence of compliance on their own. Operational check: record each high-risk finding from the review with an owner and target date, and repeat the review after major architectural changes.