Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to identify who handles the underlying operating system for an Amazon RDS DB instance, which calls for AWS managed RDS infrastructure rather than Customer application patching on EC2 or the earlier Customer RDS access controls.

Customer RDS access controls primarily supports the earlier need to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used, but the new task is to identify who handles the underlying operating system for an Amazon RDS DB instance; that is why AWS managed RDS infrastructure is preferable here.

AWS global network infrastructure is intended to determine who operates the provider-owned physical networking fabric because AWS manages its worldwide network infrastructure and physical connectivity within its facilities; in this design the new outcome is to identify who handles the underlying operating system for an Amazon RDS DB instance, which calls for AWS managed RDS infrastructure rather than AWS global network infrastructure or the earlier Customer RDS access controls.

That description belongs to Amazon Inspector because inspector identifies vulnerability and exposure findings for covered resources; it is used to assess supported workloads for exploitable software weaknesses, not to explain how AWS Config provides the function to identify changes in supported AWS resource settings over time.

That description belongs to Amazon Macie because macie discovers and classifies sensitive information in supported S3 data; it is used to identify potentially sensitive data stored in Amazon S3, not to explain how AWS Config provides the function to identify changes in supported AWS resource settings over time.

That description belongs to AWS Shield Standard because shield Standard supplies automatic DDoS protection to supported resources; it is used to provide baseline DDoS protections for supported AWS resources, not to explain how AWS Config provides the function to identify changes in supported AWS resource settings over time.

IAM permissions boundary primarily supports the earlier need to limit the maximum permissions an identity policy can grant to a user or role because a permissions boundary acts as a ceiling on effective identity-based permissions, but the new task is to limit authorized requests using context such as MFA, source or tags where supported; that is why IAM policy condition is preferable here.

Temporary session credentials is intended to avoid long-lived application secrets when making authorized AWS requests because temporary credentials expire and can be issued through IAM roles and federation; in this design the new outcome is to limit authorized requests using context such as MFA, source or tags where supported, which calls for IAM policy condition rather than Temporary session credentials or the earlier IAM permissions boundary.

Amazon Cognito identity pools is intended to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; in this design the new outcome is to limit authorized requests using context such as MFA, source or tags where supported, which calls for IAM policy condition rather than Amazon Cognito identity pools or the earlier IAM permissions boundary.

That description belongs to Customer compliance obligations because customers remain responsible for their legal obligations, data usage and service configurations; it is used to determine who ensures application use and data handling meet the customer's regulations, not to explain how Customer EC2 guest OS patching provides the function to determine who installs security updates inside a customer-managed EC2 operating system.

That description belongs to AWS managed RDS infrastructure because AWS operates the managed database platform and underlying host maintenance for RDS; it is used to identify who handles the underlying operating system for an Amazon RDS DB instance, not to explain how Customer EC2 guest OS patching provides the function to determine who installs security updates inside a customer-managed EC2 operating system.

That description belongs to AWS hypervisor maintenance because AWS manages the host operating environment and virtualization components for EC2; it is used to identify who maintains the virtualization host beneath an EC2 instance, not to explain how Customer EC2 guest OS patching provides the function to determine who installs security updates inside a customer-managed EC2 operating system.

AWS Control Tower landing zone addresses a different objective, to establish governed multi-account environments with standardized controls, because control Tower orchestrates a landing zone with account governance and guardrails; the checklist instead requires the distinct outcomes to review who invoked AWS management API actions in an account; retain and correlate audit records from multiple accounts.

AWS service compliance inheritance addresses a different objective, to use AWS audited infrastructure controls as supporting evidence, because customers may inherit relevant provider controls while remaining responsible for their own controls; the checklist instead requires the distinct outcomes to review who invoked AWS management API actions in an account; retain and correlate audit records from multiple accounts.

AWS Certificate Manager TLS certificates addresses a different objective, to provision and manage certificates for supported TLS endpoints, because aCM manages public or imported certificates for use with integrated services; the checklist instead requires the distinct outcomes to review who invoked AWS management API actions in an account; retain and correlate audit records from multiple accounts.

That description belongs to AWS Trusted Advisor security checks because trusted Advisor offers checks and guidance across areas including security and cost; it is used to review common security and configuration recommendations in AWS accounts, not to explain how AWS Config configuration history provides the function to review AWS resource configuration changes and compliance state.

That description belongs to AWS Config rules because config rules assess resource settings such as encryption or approved configuration states; it is used to evaluate a configuration against a defined compliance requirement, not to explain how AWS Config configuration history provides the function to review AWS resource configuration changes and compliance state.

That description belongs to Security posture evaluation because posture tools and configuration checks compare resource settings against security standards; it is used to identify departures from approved secure configuration baselines, not to explain how AWS Config configuration history provides the function to review AWS resource configuration changes and compliance state.

Customer application patching on EC2 primarily supports the earlier need to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines, but the new task is to determine who chooses recovery retention and frequency for business workloads; that is why Customer backup policy selection is preferable here.

AWS S3 infrastructure availability is intended to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; in this design the new outcome is to determine who chooses recovery retention and frequency for business workloads, which calls for Customer backup policy selection rather than AWS S3 infrastructure availability or the earlier Customer application patching on EC2.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to determine who chooses recovery retention and frequency for business workloads, which calls for Customer backup policy selection rather than Customer EC2 guest OS patching or the earlier Customer application patching on EC2.

AWS CloudHSM addresses a different objective, to use dedicated hardware modules with direct cryptographic control, because cloudHSM provides dedicated hardware security modules for customer-managed keys and crypto operations; the checklist instead requires the distinct outcomes to retrieve third-party compliance reports relevant to AWS-operated controls; provide baseline DDoS protections for supported AWS resources.

AWS Security Hub addresses a different objective, to review centralized security posture and findings from multiple sources, because security Hub consolidates and prioritizes findings across AWS security services; the checklist instead requires the distinct outcomes to retrieve third-party compliance reports relevant to AWS-operated controls; provide baseline DDoS protections for supported AWS resources.

AWS Marketplace security solutions addresses a different objective, to obtain eligible third-party security software through AWS Marketplace, because marketplace offers third-party and AWS software listings for procurement and deployment; the checklist instead requires the distinct outcomes to retrieve third-party compliance reports relevant to AWS-operated controls; provide baseline DDoS protections for supported AWS resources.

That description belongs to IAM role temporary credentials because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; it is used to provide temporary access to a trusted principal or AWS workload, not to explain how IAM Access Analyzer policy validation provides the function to identify policy errors and security warnings before broad access is granted.

That description belongs to IAM resource-based policy because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; it is used to grant access through a policy attached to a supported resource, not to explain how IAM Access Analyzer policy validation provides the function to identify policy errors and security warnings before broad access is granted.

That description belongs to AWS Organizations member-account guardrails because organization-level policies can constrain member accounts regardless of broader IAM allows; it is used to restrict maximum access by applying organizational policies, not to explain how IAM Access Analyzer policy validation provides the function to identify policy errors and security warnings before broad access is granted.

That description belongs to AWS WAF web request filtering because wAF applies web access control rules against traffic patterns such as malicious requests; it is used to filter HTTP and HTTPS requests reaching supported applications, not to explain how AWS Certificate Manager TLS certificates provides the function to provision and manage certificates for supported TLS endpoints.

That description belongs to AWS Resource Access Manager sharing because AWS RAM enables supported resource sharing with eligible accounts or organizations; it is used to share supported AWS resources across accounts in a controlled way, not to explain how AWS Certificate Manager TLS certificates provides the function to provision and manage certificates for supported TLS endpoints.

That description belongs to AWS KMS managed keys because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; it is used to control encryption keys for supported AWS integrated services, not to explain how AWS Certificate Manager TLS certificates provides the function to provision and manage certificates for supported TLS endpoints.

AWS Knowledge Center primarily supports the earlier need to find answers to common AWS technical and security questions because the Knowledge Center provides support-style articles about known issues and features, but the new task is to read AWS-authored security guidance, news and technical practices; that is why AWS Security Blog is preferable here.

AWS Security Center is intended to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; in this design the new outcome is to read AWS-authored security guidance, news and technical practices, which calls for AWS Security Blog rather than AWS Security Center or the earlier AWS Knowledge Center.

AWS Security Hub is intended to review centralized security posture and findings from multiple sources because security Hub consolidates and prioritizes findings across AWS security services; in this design the new outcome is to read AWS-authored security guidance, news and technical practices, which calls for AWS Security Blog rather than AWS Security Hub or the earlier AWS Knowledge Center.