That description belongs to Centralized security logging because central collection helps security staff investigate activity without relying on individual workloads; it is used to retain and correlate audit records from multiple accounts, not to explain how AWS Audit Manager evidence collection provides the function to organize evidence of AWS usage for audit assessments.

That description belongs to AWS Artifact compliance reports because artifact provides self-service access to selected AWS compliance documentation and agreements; it is used to obtain AWS third-party compliance reports and contractual documents, not to explain how AWS Audit Manager evidence collection provides the function to organize evidence of AWS usage for audit assessments.

That description belongs to AWS service compliance inheritance because customers may inherit relevant provider controls while remaining responsible for their own controls; it is used to use AWS audited infrastructure controls as supporting evidence, not to explain how AWS Audit Manager evidence collection provides the function to organize evidence of AWS usage for audit assessments.

AWS managed RDS infrastructure primarily supports the earlier need to identify who handles the underlying operating system for an Amazon RDS DB instance because AWS operates the managed database platform and underlying host maintenance for RDS, but the new task is to identify who writes and secures the application logic of a Lambda function; that is why Customer Lambda function code is preferable here.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to identify who writes and secures the application logic of a Lambda function, which calls for Customer Lambda function code rather than Customer application patching on EC2 or the earlier AWS managed RDS infrastructure.

Customer RDS access controls is intended to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used; in this design the new outcome is to identify who writes and secures the application logic of a Lambda function, which calls for Customer Lambda function code rather than Customer RDS access controls or the earlier AWS managed RDS infrastructure.

AWS Secrets Manager addresses the separate need to store and rotate supported application secrets without hard-coding them because secrets Manager stores protected secrets and supports rotation workflows; it is not as direct as Avoid shared credentials for the actual requirement to retain individual accountability for actions taken in AWS.

Principle of least privilege addresses the separate need to give each identity only the access needed to do its assigned work because least privilege limits actions and resources to necessary scope; it is not as direct as Avoid shared credentials for the actual requirement to retain individual accountability for actions taken in AWS.

Multi-factor authentication (MFA) addresses the separate need to add a second authentication factor to protect interactive sign-in because mFA requires an additional factor beyond a password or equivalent first credential; it is not as direct as Avoid shared credentials for the actual requirement to retain individual accountability for actions taken in AWS.

AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to control encryption keys for supported AWS integrated services, which calls for AWS KMS managed keys rather than AWS Security Hub centralized findings or the earlier AWS Firewall Manager centralized policies.

AWS Firewall Manager centralized policies primarily supports the earlier need to apply supported firewall protections consistently across multiple AWS accounts because firewall Manager provides central policy management for protections such as WAF and Shield-related configurations, but the new task is to control encryption keys for supported AWS integrated services; that is why AWS KMS managed keys is preferable here.

AWS Certificate Manager TLS certificates is intended to provision and manage certificates for supported TLS endpoints because aCM manages public or imported certificates for use with integrated services; in this design the new outcome is to control encryption keys for supported AWS integrated services, which calls for AWS KMS managed keys rather than AWS Certificate Manager TLS certificates or the earlier AWS Firewall Manager centralized policies.

That description belongs to AWS Knowledge Center because the Knowledge Center provides support-style articles about known issues and features; it is used to find answers to common AWS technical and security questions, not to explain how AWS Firewall Manager provides the function to apply common web and network protection policies across accounts.

That description belongs to AWS Trusted Advisor because trusted Advisor provides best-practice checks in several categories; it is used to review common security and configuration opportunities alongside operational checks, not to explain how AWS Firewall Manager provides the function to apply common web and network protection policies across accounts.

That description belongs to AWS WAF managed rule groups because managed rule groups provide ready-to-use WAF rules for supported web endpoints; it is used to apply common web-request protection patterns using maintained rules, not to explain how AWS Firewall Manager provides the function to apply common web and network protection policies across accounts.

AWS Organizations SCP is intended to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; in this design the new outcome is to detect suspicious account or workload behavior from security signals, which calls for Amazon GuardDuty threat detection rather than AWS Organizations SCP or the earlier Security posture evaluation.

Security posture evaluation primarily supports the earlier need to identify departures from approved secure configuration baselines because posture tools and configuration checks compare resource settings against security standards, but the new task is to detect suspicious account or workload behavior from security signals; that is why Amazon GuardDuty threat detection is preferable here.

AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to detect suspicious account or workload behavior from security signals, which calls for Amazon GuardDuty threat detection rather than AWS Security Hub centralized findings or the earlier Security posture evaluation.

That description belongs to AWS Knowledge Center because the Knowledge Center provides support-style articles about known issues and features; it is used to find answers to common AWS technical and security questions, not to explain how AWS Marketplace security solutions provides the function to obtain eligible third-party security software through AWS Marketplace.

That description belongs to Amazon Inspector because inspector identifies vulnerability and exposure findings for covered resources; it is used to assess supported workloads for exploitable software weaknesses, not to explain how AWS Marketplace security solutions provides the function to obtain eligible third-party security software through AWS Marketplace.

That description belongs to AWS Artifact because artifact makes AWS assurance materials accessible for compliance teams; it is used to retrieve third-party compliance reports relevant to AWS-operated controls, not to explain how AWS Marketplace security solutions provides the function to obtain eligible third-party security software through AWS Marketplace.

That description belongs to AWS global network infrastructure because AWS manages its worldwide network infrastructure and physical connectivity within its facilities; it is used to determine who operates the provider-owned physical networking fabric, not to explain how AWS Lambda compute platform provides the function to identify who operates the physical and service infrastructure for Lambda execution.

That description belongs to Customer Lambda function code because customers own the code, dependencies and identity permissions they provide to a Lambda function; it is used to identify who writes and secures the application logic of a Lambda function, not to explain how AWS Lambda compute platform provides the function to identify who operates the physical and service infrastructure for Lambda execution.

That description belongs to AWS regional facility redundancy because AWS builds and operates the physical infrastructure supporting Regions and AZs; it is used to identify who maintains the independent infrastructure underlying Availability Zones, not to explain how AWS Lambda compute platform provides the function to identify who operates the physical and service infrastructure for Lambda execution.

Explicit deny precedence addresses the separate need to ensure a denied API action cannot be overridden by another allow statement because an applicable explicit deny in AWS authorization evaluation overrides applicable allows; it is not as direct as Password policy for the actual requirement to set complexity and lifetime requirements for applicable IAM user passwords.

IAM group addresses the separate need to manage similar IAM user permissions through group membership because an IAM group is a collection of IAM users that can share attached permissions policies; it is not as direct as Password policy for the actual requirement to set complexity and lifetime requirements for applicable IAM user passwords.

Customer managed IAM policies addresses the separate need to reuse an organization-authored permissions policy across appropriate identities because customer managed policies allow centralized versioning and reuse of customized permissions; it is not as direct as Password policy for the actual requirement to set complexity and lifetime requirements for applicable IAM user passwords.

That description belongs to Amazon Inspector because inspector identifies vulnerability and exposure findings for covered resources; it is used to assess supported workloads for exploitable software weaknesses, not to explain how AWS IAM Access Analyzer provides the function to detect external sharing and analyze access policies for supported resources.

That description belongs to AWS Security Center because AWS security portals collect information about AWS cloud security capabilities; it is used to find AWS security resources and information in one place, not to explain how AWS IAM Access Analyzer provides the function to detect external sharing and analyze access policies for supported resources.

That description belongs to AWS Shield Standard because shield Standard supplies automatic DDoS protection to supported resources; it is used to provide baseline DDoS protections for supported AWS resources, not to explain how AWS IAM Access Analyzer provides the function to detect external sharing and analyze access policies for supported resources.

AWS Artifact compliance reports addresses the separate need to obtain AWS third-party compliance reports and contractual documents because artifact provides self-service access to selected AWS compliance documentation and agreements; it is not as direct as Centralized security logging for the actual requirement to retain and correlate audit records from multiple accounts.

AWS Security Lake centralized security data addresses the separate need to collect security logs in an analyzable data lake because security Lake can centralize supported security event and log data for analysis; it is not as direct as Centralized security logging for the actual requirement to retain and correlate audit records from multiple accounts.

AWS Organizations SCP addresses the separate need to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; it is not as direct as Centralized security logging for the actual requirement to retain and correlate audit records from multiple accounts.