That description belongs to Customer backup policy selection because customers establish data recovery objectives and configure suitable backups or managed-service settings; it is used to determine who chooses recovery retention and frequency for business workloads, not to explain how Customer VPC network design provides the function to determine who selects subnets, routes and exposure within a VPC.

That description belongs to AWS global network infrastructure because AWS manages its worldwide network infrastructure and physical connectivity within its facilities; it is used to determine who operates the provider-owned physical networking fabric, not to explain how Customer VPC network design provides the function to determine who selects subnets, routes and exposure within a VPC.

That description belongs to Customer application patching on EC2 because the customer is responsible for custom code and software installed on its virtual machines; it is used to determine who updates software installed by a customer on an EC2 VM, not to explain how Customer VPC network design provides the function to determine who selects subnets, routes and exposure within a VPC.

Amazon Cognito user pools addresses the separate need to support sign-up and authentication of application end users because cognito user pools provide user directories and authentication features for apps; it is not as direct as Root user credential protection for the actual requirement to reduce exposure of the AWS account's highly privileged root identity.

IAM user addresses the separate need to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions; it is not as direct as Root user credential protection for the actual requirement to reduce exposure of the AWS account's highly privileged root identity.

IAM Access Analyzer policy validation addresses the separate need to identify policy errors and security warnings before broad access is granted because policy validation analyzes IAM policy documents for issues and best-practice findings; it is not as direct as Root user credential protection for the actual requirement to reduce exposure of the AWS account's highly privileged root identity.

AWS WAF managed rule groups addresses the separate need to apply common web-request protection patterns using maintained rules because managed rule groups provide ready-to-use WAF rules for supported web endpoints; it is not as direct as AWS Marketplace security solutions for the actual requirement to obtain eligible third-party security software through AWS Marketplace.

AWS Firewall Manager addresses the separate need to apply common web and network protection policies across accounts because firewall Manager helps centrally deploy supported security protections; it is not as direct as AWS Marketplace security solutions for the actual requirement to obtain eligible third-party security software through AWS Marketplace.

AWS Artifact addresses the separate need to retrieve third-party compliance reports relevant to AWS-operated controls because artifact makes AWS assurance materials accessible for compliance teams; it is not as direct as AWS Marketplace security solutions for the actual requirement to obtain eligible third-party security software through AWS Marketplace.

Permission sets for account assignments addresses the separate need to standardize workforce role assignments across multiple AWS accounts because IAM Identity Center permission sets help define permissions provisioned for assigned users or groups; it is not as direct as Cross-account role assumption for the actual requirement to allow a principal in one AWS account to gain defined temporary permissions in another.

IAM permissions boundary addresses the separate need to limit the maximum permissions an identity policy can grant to a user or role because a permissions boundary acts as a ceiling on effective identity-based permissions; it is not as direct as Cross-account role assumption for the actual requirement to allow a principal in one AWS account to gain defined temporary permissions in another.

AWS Systems Manager Parameter Store addresses the separate need to store configuration parameters and selected secrets for applications because parameter Store provides hierarchical parameter values with access controlled through IAM; it is not as direct as Cross-account role assumption for the actual requirement to allow a principal in one AWS account to gain defined temporary permissions in another.

Customer compliance obligations primarily supports the earlier need to determine who ensures application use and data handling meet the customer's regulations because customers remain responsible for their legal obligations, data usage and service configurations, but the new task is to decide who labels business data by sensitivity before selecting controls; that is why Customer data classification is preferable here.

Customer S3 bucket policy is intended to decide who restricts public or cross-account access to stored objects because customers own S3 authorization configuration such as bucket policies and access settings; in this design the new outcome is to decide who labels business data by sensitivity before selecting controls, which calls for Customer data classification rather than Customer S3 bucket policy or the earlier Customer compliance obligations.

Customer encryption configuration is intended to decide who chooses encryption settings and key access rules for customer information because customers select appropriate encryption options and configure permissions for data protection; in this design the new outcome is to decide who labels business data by sensitivity before selecting controls, which calls for Customer data classification rather than Customer encryption configuration or the earlier Customer compliance obligations.

AWS Organizations SCP addresses the separate need to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; it is not as direct as AWS Control Tower landing zone for the actual requirement to establish governed multi-account environments with standardized controls.

AWS Shield DDoS protection addresses the separate need to reduce the effect of distributed denial-of-service attacks on supported applications because shield provides DDoS protection for supported AWS resources, with additional capabilities in advanced offerings; it is not as direct as AWS Control Tower landing zone for the actual requirement to establish governed multi-account environments with standardized controls.

Security posture evaluation addresses the separate need to identify departures from approved secure configuration baselines because posture tools and configuration checks compare resource settings against security standards; it is not as direct as AWS Control Tower landing zone for the actual requirement to establish governed multi-account environments with standardized controls.

AWS Security Blog addresses the separate need to read AWS-authored security guidance, news and technical practices because the AWS Security Blog publishes security-focused articles and examples; it is not as direct as AWS Well-Architected Tool for the actual requirement to review a workload against architectural best practices including security.

AWS Knowledge Center addresses the separate need to find answers to common AWS technical and security questions because the Knowledge Center provides support-style articles about known issues and features; it is not as direct as AWS Well-Architected Tool for the actual requirement to review a workload against architectural best practices including security.

AWS Security Hub addresses the separate need to review centralized security posture and findings from multiple sources because security Hub consolidates and prioritizes findings across AWS security services; it is not as direct as AWS Well-Architected Tool for the actual requirement to review a workload against architectural best practices including security.

Customer data classification is intended to decide who labels business data by sensitivity before selecting controls because customers classify information and determine required access and protection levels; in this design the new outcome is to decide who restricts public or cross-account access to stored objects, which calls for Customer S3 bucket policy rather than Customer data classification or the earlier Customer IAM permission design.

Customer logging and retention settings is intended to decide who enables appropriate activity logging and keeps records as required because customers configure service logging, centralize records and apply retention policies to their workloads; in this design the new outcome is to decide who restricts public or cross-account access to stored objects, which calls for Customer S3 bucket policy rather than Customer logging and retention settings or the earlier Customer IAM permission design.

Customer IAM permission design primarily supports the earlier need to decide who grants access permissions to customer data and AWS resources because customers create access rules and identities suited to organizational least-privilege requirements, but the new task is to decide who restricts public or cross-account access to stored objects; that is why Customer S3 bucket policy is preferable here.

AWS Shield Standard addresses the separate need to provide baseline DDoS protections for supported AWS resources because shield Standard supplies automatic DDoS protection to supported resources; it is not as direct as AWS Knowledge Center for the actual requirement to find answers to common AWS technical and security questions.

AWS Trusted Advisor addresses the separate need to review common security and configuration opportunities alongside operational checks because trusted Advisor provides best-practice checks in several categories; it is not as direct as AWS Knowledge Center for the actual requirement to find answers to common AWS technical and security questions.

AWS IAM Access Analyzer addresses the separate need to detect external sharing and analyze access policies for supported resources because access Analyzer produces findings and policy analysis that aid least-privilege reviews; it is not as direct as AWS Knowledge Center for the actual requirement to find answers to common AWS technical and security questions.

That description belongs to IAM Identity Center workforce access because IAM Identity Center supports workforce federation and permission-set based access; it is used to centralize human access to multiple AWS accounts and supported applications, not to explain how Permission sets for account assignments provides the function to standardize workforce role assignments across multiple AWS accounts.

That description belongs to Service-linked IAM role because service-linked roles are tied to AWS services and have constrained predefined service purposes; it is used to delegate service-specific operations to an AWS service under a defined role, not to explain how Permission sets for account assignments provides the function to standardize workforce role assignments across multiple AWS accounts.

That description belongs to IAM Identity Center external directory because identity Center can work with supported external identity sources for centralized access; it is used to integrate existing workforce identities with AWS account access, not to explain how Permission sets for account assignments provides the function to standardize workforce role assignments across multiple AWS accounts.

That description belongs to Centralized security logging because central collection helps security staff investigate activity without relying on individual workloads; it is used to retain and correlate audit records from multiple accounts, not to explain how AWS Audit Manager evidence collection provides the function to organize evidence of AWS usage for audit assessments.

That description belongs to AWS Artifact compliance reports because artifact provides self-service access to selected AWS compliance documentation and agreements; it is used to obtain AWS third-party compliance reports and contractual documents, not to explain how AWS Audit Manager evidence collection provides the function to organize evidence of AWS usage for audit assessments.

That description belongs to AWS service compliance inheritance because customers may inherit relevant provider controls while remaining responsible for their own controls; it is used to use AWS audited infrastructure controls as supporting evidence, not to explain how AWS Audit Manager evidence collection provides the function to organize evidence of AWS usage for audit assessments.