AWS Certificate Manager TLS certificates is intended to provision and manage certificates for supported TLS endpoints because aCM manages public or imported certificates for use with integrated services; in this design the new outcome is to filter HTTP and HTTPS requests reaching supported applications, which calls for AWS WAF web request filtering rather than AWS Certificate Manager TLS certificates or the earlier Amazon GuardDuty threat detection.

Amazon GuardDuty threat detection primarily supports the earlier need to detect suspicious account or workload behavior from security signals because guardDuty analyzes supported event and telemetry sources to identify potential malicious activity, but the new task is to filter HTTP and HTTPS requests reaching supported applications; that is why AWS WAF web request filtering is preferable here.

AWS KMS managed keys is intended to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; in this design the new outcome is to filter HTTP and HTTPS requests reaching supported applications, which calls for AWS WAF web request filtering rather than AWS KMS managed keys or the earlier Amazon GuardDuty threat detection.

AWS WAF managed rule groups addresses a different objective, to apply common web-request protection patterns using maintained rules, because managed rule groups provide ready-to-use WAF rules for supported web endpoints; the checklist instead requires the distinct outcomes to assess supported workloads for exploitable software weaknesses; read AWS-authored security guidance, news and technical practices; review centralized security posture and findings from multiple sources.

Amazon Macie addresses a different objective, to identify potentially sensitive data stored in Amazon S3, because macie discovers and classifies sensitive information in supported S3 data; the checklist instead requires the distinct outcomes to assess supported workloads for exploitable software weaknesses; read AWS-authored security guidance, news and technical practices; review centralized security posture and findings from multiple sources.

Amazon GuardDuty addresses a different objective, to surface suspicious activity using threat intelligence and anomaly analysis, because guardDuty detects potential security threats from supported AWS signals; the checklist instead requires the distinct outcomes to assess supported workloads for exploitable software weaknesses; read AWS-authored security guidance, news and technical practices; review centralized security posture and findings from multiple sources.

AWS Config rules addresses the separate need to evaluate a configuration against a defined compliance requirement because config rules assess resource settings such as encryption or approved configuration states; it is not as direct as Separation of duties for the actual requirement to prevent one principal from controlling incompatible business functions.

Amazon CloudWatch metrics addresses the separate need to observe resource utilization and service performance over time because cloudWatch gathers metrics, alarms and logs for operational monitoring; it is not as direct as Separation of duties for the actual requirement to prevent one principal from controlling incompatible business functions.

AWS CloudTrail event history addresses the separate need to review who invoked AWS management API actions in an account because cloudTrail records AWS account API activity and supports investigation of management actions; it is not as direct as Separation of duties for the actual requirement to prevent one principal from controlling incompatible business functions.

Amazon Cognito identity pools addresses a different objective, to provide AWS credentials to application users using supported identities, because cognito identity pools exchange supported authentication for temporary AWS credentials; the checklist instead requires the distinct outcomes to let an existing external identity provider authenticate users for AWS access; use a predefined AWS-maintained permissions policy when its scope is appropriate.

IAM role temporary credentials addresses a different objective, to provide temporary access to a trusted principal or AWS workload, because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; the checklist instead requires the distinct outcomes to let an existing external identity provider authenticate users for AWS access; use a predefined AWS-maintained permissions policy when its scope is appropriate.

IAM role trust policy addresses a different objective, to define which principals are allowed to assume a specific role, because a role trust policy controls the trusted entities for role assumption; the checklist instead requires the distinct outcomes to let an existing external identity provider authenticate users for AWS access; use a predefined AWS-maintained permissions policy when its scope is appropriate.

That description belongs to AWS hypervisor maintenance because AWS manages the host operating environment and virtualization components for EC2; it is used to identify who maintains the virtualization host beneath an EC2 instance, not to explain how AWS physical data-center security provides the function to identify who protects buildings, hardware and physical facilities.

That description belongs to AWS S3 infrastructure availability because AWS manages the underlying hardware, facilities and service platform for S3; it is used to identify who maintains the infrastructure used to operate Amazon S3, not to explain how AWS physical data-center security provides the function to identify who protects buildings, hardware and physical facilities.

That description belongs to AWS managed RDS infrastructure because AWS operates the managed database platform and underlying host maintenance for RDS; it is used to identify who handles the underlying operating system for an Amazon RDS DB instance, not to explain how AWS physical data-center security provides the function to identify who protects buildings, hardware and physical facilities.

AWS WAF managed rule groups addresses the separate need to apply common web-request protection patterns using maintained rules because managed rule groups provide ready-to-use WAF rules for supported web endpoints; it is not as direct as AWS Certificate Manager for the actual requirement to manage TLS certificates for integrated AWS applications.

AWS Config addresses the separate need to identify changes in supported AWS resource settings over time because config maintains resource configuration history and compliance evaluations; it is not as direct as AWS Certificate Manager for the actual requirement to manage TLS certificates for integrated AWS applications.

AWS Well-Architected Tool addresses the separate need to review a workload against architectural best practices including security because the Well-Architected Tool provides structured questions and improvement recommendations; it is not as direct as AWS Certificate Manager for the actual requirement to manage TLS certificates for integrated AWS applications.

AWS Security Center addresses the separate need to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; it is not as direct as AWS Certificate Manager for the actual requirement to manage TLS certificates for integrated AWS applications.

Customer EC2 security groups is intended to decide who configures firewall rules around a customer instance because customers choose inbound and outbound security-group permissions for their resources; in this design the new outcome is to identify who protects buildings, hardware and physical facilities, which calls for AWS physical data-center security rather than Customer EC2 security groups or the earlier AWS Lambda compute platform.

AWS Lambda compute platform primarily supports the earlier need to identify who operates the physical and service infrastructure for Lambda execution because AWS runs and scales the underlying Lambda compute service and manages its infrastructure, but the new task is to identify who protects buildings, hardware and physical facilities; that is why AWS physical data-center security is preferable here.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to identify who protects buildings, hardware and physical facilities, which calls for AWS physical data-center security rather than Customer application patching on EC2 or the earlier AWS Lambda compute platform.

IAM identity-based policy primarily supports the earlier need to define what actions an IAM principal may perform on specified resources because identity-based policies attach to users, groups or roles and express allowed or denied actions, but the new task is to define which AWS operations a successfully assumed role can perform; that is why IAM role permissions policy is preferable here.

Permission sets for account assignments is intended to standardize workforce role assignments across multiple AWS accounts because IAM Identity Center permission sets help define permissions provisioned for assigned users or groups; in this design the new outcome is to define which AWS operations a successfully assumed role can perform, which calls for IAM role permissions policy rather than Permission sets for account assignments or the earlier IAM identity-based policy.

IAM permissions boundary is intended to limit the maximum permissions an identity policy can grant to a user or role because a permissions boundary acts as a ceiling on effective identity-based permissions; in this design the new outcome is to define which AWS operations a successfully assumed role can perform, which calls for IAM role permissions policy rather than IAM permissions boundary or the earlier IAM identity-based policy.

That description belongs to AWS Firewall Manager centralized policies because firewall Manager provides central policy management for protections such as WAF and Shield-related configurations; it is used to apply supported firewall protections consistently across multiple AWS accounts, not to explain how Centralized security logging provides the function to retain and correlate audit records from multiple accounts.

That description belongs to AWS Audit Manager evidence collection because audit Manager helps collect and organize evidence against control frameworks; it is used to organize evidence of AWS usage for audit assessments, not to explain how Centralized security logging provides the function to retain and correlate audit records from multiple accounts.

That description belongs to AWS Trusted Advisor security checks because trusted Advisor offers checks and guidance across areas including security and cost; it is used to review common security and configuration recommendations in AWS accounts, not to explain how Centralized security logging provides the function to retain and correlate audit records from multiple accounts.

AWS KMS is intended to manage cryptographic keys and their authorized use in AWS services because kMS integrates managed keys with many AWS encryption workflows; in this design the new outcome is to use dedicated hardware modules with direct cryptographic control, which calls for AWS CloudHSM rather than AWS KMS or the earlier AWS Firewall Manager.

AWS WAF managed rule groups is intended to apply common web-request protection patterns using maintained rules because managed rule groups provide ready-to-use WAF rules for supported web endpoints; in this design the new outcome is to use dedicated hardware modules with direct cryptographic control, which calls for AWS CloudHSM rather than AWS WAF managed rule groups or the earlier AWS Firewall Manager.

AWS Firewall Manager primarily supports the earlier need to apply common web and network protection policies across accounts because firewall Manager helps centrally deploy supported security protections, but the new task is to use dedicated hardware modules with direct cryptographic control; that is why AWS CloudHSM is preferable here.

That description belongs to Customer application patching on EC2 because the customer is responsible for custom code and software installed on its virtual machines; it is used to determine who updates software installed by a customer on an EC2 VM, not to explain how Customer encryption configuration provides the function to decide who chooses encryption settings and key access rules for customer information.

That description belongs to Customer S3 bucket policy because customers own S3 authorization configuration such as bucket policies and access settings; it is used to decide who restricts public or cross-account access to stored objects, not to explain how Customer encryption configuration provides the function to decide who chooses encryption settings and key access rules for customer information.

That description belongs to Customer backup policy selection because customers establish data recovery objectives and configure suitable backups or managed-service settings; it is used to determine who chooses recovery retention and frequency for business workloads, not to explain how Customer encryption configuration provides the function to decide who chooses encryption settings and key access rules for customer information.