AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to protect information stored on disks or in object services, which calls for Encryption at rest rather than AWS Security Hub centralized findings or the earlier Amazon Macie sensitive-data discovery.

Amazon Macie sensitive-data discovery primarily supports the earlier need to locate sensitive information such as personal data in Amazon S3 because macie uses machine learning and pattern matching to discover sensitive data in S3, but the new task is to protect information stored on disks or in object services; that is why Encryption at rest is preferable here.

AWS KMS managed keys is intended to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; in this design the new outcome is to protect information stored on disks or in object services, which calls for Encryption at rest rather than AWS KMS managed keys or the earlier Amazon Macie sensitive-data discovery.

That description belongs to IAM Identity Center external directory because identity Center can work with supported external identity sources for centralized access; it is used to integrate existing workforce identities with AWS account access, not to explain how Federated identity access provides the function to let an existing external identity provider authenticate users for AWS access.

That description belongs to IAM role temporary credentials because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; it is used to provide temporary access to a trusted principal or AWS workload, not to explain how Federated identity access provides the function to let an existing external identity provider authenticate users for AWS access.

That description belongs to Principle of least privilege because least privilege limits actions and resources to necessary scope; it is used to give each identity only the access needed to do its assigned work, not to explain how Federated identity access provides the function to let an existing external identity provider authenticate users for AWS access.

AWS Marketplace security solutions primarily supports the earlier need to obtain eligible third-party security software through AWS Marketplace because marketplace offers third-party and AWS software listings for procurement and deployment, but the new task is to provide baseline DDoS protections for supported AWS resources; that is why AWS Shield Standard is preferable here.

AWS Security Center is intended to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; in this design the new outcome is to provide baseline DDoS protections for supported AWS resources, which calls for AWS Shield Standard rather than AWS Security Center or the earlier AWS Marketplace security solutions.

Amazon Inspector is intended to assess supported workloads for exploitable software weaknesses because inspector identifies vulnerability and exposure findings for covered resources; in this design the new outcome is to provide baseline DDoS protections for supported AWS resources, which calls for AWS Shield Standard rather than Amazon Inspector or the earlier AWS Marketplace security solutions.

Amazon CloudWatch metrics addresses the separate need to observe resource utilization and service performance over time because cloudWatch gathers metrics, alarms and logs for operational monitoring; it is not as direct as Amazon Inspector vulnerability findings for the actual requirement to identify software vulnerabilities and unintended network exposure on supported workloads.

AWS CloudHSM dedicated HSMs addresses the separate need to use customer-controlled single-tenant hardware security modules for key workloads because cloudHSM offers dedicated HSM capacity for supported cryptographic applications; it is not as direct as Amazon Inspector vulnerability findings for the actual requirement to identify software vulnerabilities and unintended network exposure on supported workloads.

Regional service eligibility addresses the separate need to verify whether a required service and control are available in the chosen AWS Region because services, compliance capabilities and data-processing locations can differ by Region; it is not as direct as Amazon Inspector vulnerability findings for the actual requirement to identify software vulnerabilities and unintended network exposure on supported workloads.

That description belongs to AWS physical data-center security because AWS controls physical access, environmental safeguards and infrastructure facilities supporting its services; it is used to identify who protects buildings, hardware and physical facilities, not to explain how AWS hardware lifecycle provides the function to identify who replaces failed drives and server components in AWS facilities.

That description belongs to AWS S3 infrastructure availability because AWS manages the underlying hardware, facilities and service platform for S3; it is used to identify who maintains the infrastructure used to operate Amazon S3, not to explain how AWS hardware lifecycle provides the function to identify who replaces failed drives and server components in AWS facilities.

That description belongs to AWS hypervisor maintenance because AWS manages the host operating environment and virtualization components for EC2; it is used to identify who maintains the virtualization host beneath an EC2 instance, not to explain how AWS hardware lifecycle provides the function to identify who replaces failed drives and server components in AWS facilities.

Encrypting stored volumes does not automatically encrypt every network connection; that caveat is associated more closely with Encryption in transit for the need to protect information while it travels over a network than with Amazon CloudWatch metrics for the requirement to observe resource utilization and service performance over time.

It is different from a record of every API caller's account actions; that caveat is associated more closely with AWS Config configuration history for the need to review AWS resource configuration changes and compliance state than with Amazon CloudWatch metrics for the requirement to observe resource utilization and service performance over time.

Shield is not a general SQL injection filter for custom web application parameters; that caveat is associated more closely with AWS Shield DDoS protection for the need to reduce the effect of distributed denial-of-service attacks on supported applications than with Amazon CloudWatch metrics for the requirement to observe resource utilization and service performance over time.

Customer data classification addresses a different objective, to decide who labels business data by sensitivity before selecting controls, because customers classify information and determine required access and protection levels; the checklist instead requires the distinct outcomes to determine who updates software installed by a customer on an EC2 VM; recognize how patch duties differ between provider hosts and customer-managed instances.

Customer EC2 guest OS patching addresses a different objective, to determine who installs security updates inside a customer-managed EC2 operating system, because customers maintain the guest OS, including relevant patches, configuration and hardening; the checklist instead requires the distinct outcomes to determine who updates software installed by a customer on an EC2 VM; recognize how patch duties differ between provider hosts and customer-managed instances.

AWS S3 infrastructure availability addresses a different objective, to identify who maintains the infrastructure used to operate Amazon S3, because AWS manages the underlying hardware, facilities and service platform for S3; the checklist instead requires the distinct outcomes to determine who updates software installed by a customer on an EC2 VM; recognize how patch duties differ between provider hosts and customer-managed instances.

Documentation portals do not directly scan running code for CVEs; that caveat is associated more closely with AWS Security Center for the need to find AWS security resources and information in one place than with AWS Marketplace security solutions for the requirement to obtain eligible third-party security software through AWS Marketplace.

It is reference material, not a log collection service; that caveat is associated more closely with AWS Knowledge Center for the need to find answers to common AWS technical and security questions than with AWS Marketplace security solutions for the requirement to obtain eligible third-party security software through AWS Marketplace.

It does not focus on writing HTTP request-blocking rules; that caveat is associated more closely with Amazon Inspector for the need to assess supported workloads for exploitable software weaknesses than with AWS Marketplace security solutions for the requirement to obtain eligible third-party security software through AWS Marketplace.

That description belongs to IAM access keys because an access key ID and secret key can sign API requests but require careful protection and rotation; it is used to authorize programmatic AWS API access for a permitted IAM principal, not to explain how IAM identity-based policy provides the function to define what actions an IAM principal may perform on specified resources.

That description belongs to Avoid shared credentials because separate identities and temporary role sessions support attribution and selective access removal; it is used to retain individual accountability for actions taken in AWS, not to explain how IAM identity-based policy provides the function to define what actions an IAM principal may perform on specified resources.

That description belongs to IAM role permissions policy because permissions policies attached to a role determine allowed service actions within other policy limits; it is used to define which AWS operations a successfully assumed role can perform, not to explain how IAM identity-based policy provides the function to define what actions an IAM principal may perform on specified resources.

AWS Security Center is intended to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; in this design the new outcome is to provide baseline DDoS protections for supported AWS resources, which calls for AWS Shield Standard rather than AWS Security Center or the earlier AWS IAM Access Analyzer.

Amazon Inspector is intended to assess supported workloads for exploitable software weaknesses because inspector identifies vulnerability and exposure findings for covered resources; in this design the new outcome is to provide baseline DDoS protections for supported AWS resources, which calls for AWS Shield Standard rather than Amazon Inspector or the earlier AWS IAM Access Analyzer.

AWS IAM Access Analyzer primarily supports the earlier need to detect external sharing and analyze access policies for supported resources because access Analyzer produces findings and policy analysis that aid least-privilege reviews, but the new task is to provide baseline DDoS protections for supported AWS resources; that is why AWS Shield Standard is preferable here.

AWS regional facility redundancy addresses the separate need to identify who maintains the independent infrastructure underlying Availability Zones because AWS builds and operates the physical infrastructure supporting Regions and AZs; it is not as direct as Customer application patching on EC2 for the actual requirement to determine who updates software installed by a customer on an EC2 VM.

Customer EC2 guest OS patching addresses the separate need to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; it is not as direct as Customer application patching on EC2 for the actual requirement to determine who updates software installed by a customer on an EC2 VM.

Customer S3 bucket policy addresses the separate need to decide who restricts public or cross-account access to stored objects because customers own S3 authorization configuration such as bucket policies and access settings; it is not as direct as Customer application patching on EC2 for the actual requirement to determine who updates software installed by a customer on an EC2 VM.