AWS Knowledge Center primarily supports the earlier need to find answers to common AWS technical and security questions because the Knowledge Center provides support-style articles about known issues and features, but the new task is to read AWS-authored security guidance, news and technical practices; that is why AWS Security Blog is preferable here.

AWS Security Center is intended to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; in this design the new outcome is to read AWS-authored security guidance, news and technical practices, which calls for AWS Security Blog rather than AWS Security Center or the earlier AWS Knowledge Center.

AWS Security Hub is intended to review centralized security posture and findings from multiple sources because security Hub consolidates and prioritizes findings across AWS security services; in this design the new outcome is to read AWS-authored security guidance, news and technical practices, which calls for AWS Security Blog rather than AWS Security Hub or the earlier AWS Knowledge Center.

Root user credential protection addresses the separate need to reduce exposure of the AWS account's highly privileged root identity because AWS recommends protecting root credentials, enabling MFA and avoiding routine root use; it is not as direct as IAM policy condition for the actual requirement to limit authorized requests using context such as MFA, source or tags where supported.

Password policy addresses the separate need to set complexity and lifetime requirements for applicable IAM user passwords because account password policy governs certain IAM user console passwords; it is not as direct as IAM policy condition for the actual requirement to limit authorized requests using context such as MFA, source or tags where supported.

IAM resource-based policy addresses the separate need to grant access through a policy attached to a supported resource because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; it is not as direct as IAM policy condition for the actual requirement to limit authorized requests using context such as MFA, source or tags where supported.

IAM role temporary credentials addresses the separate need to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; it is not as direct as IAM policy condition for the actual requirement to limit authorized requests using context such as MFA, source or tags where supported.

AWS cannot independently decide which customer records constitute confidential business data; that caveat is associated more closely with Customer data classification for the need to decide who labels business data by sensitivity before selecting controls than with Customer encryption configuration for the requirement to decide who chooses encryption settings and key access rules for customer information.

Using EC2 does not transfer guest-level operating-system upkeep to AWS; that caveat is associated more closely with Customer EC2 guest OS patching for the need to determine who installs security updates inside a customer-managed EC2 operating system than with Customer encryption configuration for the requirement to decide who chooses encryption settings and key access rules for customer information.

AWS certifications help demonstrate provider controls but do not certify every customer's application; that caveat is associated more closely with Customer compliance obligations for the need to determine who ensures application use and data handling meet the customer's regulations than with Customer encryption configuration for the requirement to decide who chooses encryption settings and key access rules for customer information.

Customer Lambda function code addresses the separate need to identify who writes and secures the application logic of a Lambda function because customers own the code, dependencies and identity permissions they provide to a Lambda function; it is not as direct as AWS hypervisor maintenance for the actual requirement to identify who maintains the virtualization host beneath an EC2 instance.

AWS S3 infrastructure availability addresses the separate need to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; it is not as direct as AWS hypervisor maintenance for the actual requirement to identify who maintains the virtualization host beneath an EC2 instance.

AWS Lambda compute platform addresses the separate need to identify who operates the physical and service infrastructure for Lambda execution because AWS runs and scales the underlying Lambda compute service and manages its infrastructure; it is not as direct as AWS hypervisor maintenance for the actual requirement to identify who maintains the virtualization host beneath an EC2 instance.

Customer logging and retention settings addresses the separate need to decide who enables appropriate activity logging and keeps records as required because customers configure service logging, centralize records and apply retention policies to their workloads; it is not as direct as AWS hypervisor maintenance for the actual requirement to identify who maintains the virtualization host beneath an EC2 instance.

Security posture evaluation is intended to identify departures from approved secure configuration baselines because posture tools and configuration checks compare resource settings against security standards; in this design the new outcome is to evaluate a configuration against a defined compliance requirement, which calls for AWS Config rules rather than Security posture evaluation or the earlier AWS Security Lake centralized security data.

AWS Security Lake centralized security data primarily supports the earlier need to collect security logs in an analyzable data lake because security Lake can centralize supported security event and log data for analysis, but the new task is to evaluate a configuration against a defined compliance requirement; that is why AWS Config rules is preferable here.

AWS Trusted Advisor security checks is intended to review common security and configuration recommendations in AWS accounts because trusted Advisor offers checks and guidance across areas including security and cost; in this design the new outcome is to evaluate a configuration against a defined compliance requirement, which calls for AWS Config rules rather than AWS Trusted Advisor security checks or the earlier AWS Security Lake centralized security data.

Inline IAM policy primarily supports the earlier need to bind a permissions policy directly to one identity rather than sharing it because an inline policy maintains a one-to-one association with an IAM user, group or role, but the new task is to ensure a denied API action cannot be overridden by another allow statement; that is why Explicit deny precedence is preferable here.

Cross-account role assumption is intended to allow a principal in one AWS account to gain defined temporary permissions in another because a cross-account role requires suitable trust and permission configuration; in this design the new outcome is to ensure a denied API action cannot be overridden by another allow statement, which calls for Explicit deny precedence rather than Cross-account role assumption or the earlier Inline IAM policy.

IAM access keys is intended to authorize programmatic AWS API access for a permitted IAM principal because an access key ID and secret key can sign API requests but require careful protection and rotation; in this design the new outcome is to ensure a denied API action cannot be overridden by another allow statement, which calls for Explicit deny precedence rather than IAM access keys or the earlier Inline IAM policy.

AWS WAF managed rule groups primarily supports the earlier need to apply common web-request protection patterns using maintained rules because managed rule groups provide ready-to-use WAF rules for supported web endpoints, but the new task is to identify potentially sensitive data stored in Amazon S3; that is why Amazon Macie is preferable here.

AWS Shield Standard is intended to provide baseline DDoS protections for supported AWS resources because shield Standard supplies automatic DDoS protection to supported resources; in this design the new outcome is to identify potentially sensitive data stored in Amazon S3, which calls for Amazon Macie rather than AWS Shield Standard or the earlier AWS WAF managed rule groups.

AWS Config is intended to identify changes in supported AWS resource settings over time because config maintains resource configuration history and compliance evaluations; in this design the new outcome is to identify potentially sensitive data stored in Amazon S3, which calls for Amazon Macie rather than AWS Config or the earlier AWS WAF managed rule groups.

A customer cannot configure the AWS data-center building's access systems; that caveat is associated more closely with AWS physical data-center security for the need to identify who protects buildings, hardware and physical facilities than with Customer application patching on EC2 for the requirement to determine who updates software installed by a customer on an EC2 VM.

Customers still choose bucket permissions and intended object retention settings; that caveat is associated more closely with AWS S3 infrastructure availability for the need to identify who maintains the infrastructure used to operate Amazon S3 than with Customer application patching on EC2 for the requirement to determine who updates software installed by a customer on an EC2 VM.

Customers still configure their database, data access, networking and supported maintenance preferences; that caveat is associated more closely with AWS managed RDS infrastructure for the need to identify who handles the underlying operating system for an Amazon RDS DB instance than with Customer application patching on EC2 for the requirement to determine who updates software installed by a customer on an EC2 VM.

Amazon Cognito user pools addresses the separate need to support sign-up and authentication of application end users because cognito user pools provide user directories and authentication features for apps; it is not as direct as Credential rotation for the actual requirement to reduce risk when long-lived programmatic secrets must be retained.

AWS Systems Manager Parameter Store addresses the separate need to store configuration parameters and selected secrets for applications because parameter Store provides hierarchical parameter values with access controlled through IAM; it is not as direct as Credential rotation for the actual requirement to reduce risk when long-lived programmatic secrets must be retained.

IAM resource-based policy addresses the separate need to grant access through a policy attached to a supported resource because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; it is not as direct as Credential rotation for the actual requirement to reduce risk when long-lived programmatic secrets must be retained.

AWS CloudHSM is intended to use dedicated hardware modules with direct cryptographic control because cloudHSM provides dedicated hardware security modules for customer-managed keys and crypto operations; in this design the new outcome is to manage cryptographic keys and their authorized use in AWS services, which calls for AWS KMS rather than AWS CloudHSM or the earlier AWS Firewall Manager.

AWS Certificate Manager is intended to manage TLS certificates for integrated AWS applications because aCM can provision and manage certificates used on supported encrypted endpoints; in this design the new outcome is to manage cryptographic keys and their authorized use in AWS services, which calls for AWS KMS rather than AWS Certificate Manager or the earlier AWS Firewall Manager.

AWS Firewall Manager primarily supports the earlier need to apply common web and network protection policies across accounts because firewall Manager helps centrally deploy supported security protections, but the new task is to manage cryptographic keys and their authorized use in AWS services; that is why AWS KMS is preferable here.

Encryption in transit addresses the separate need to protect information while it travels over a network because tLS and similar protocols help secure data exchanged between clients and services; it is not as direct as AWS Trusted Advisor security checks for the actual requirement to review common security and configuration recommendations in AWS accounts.

AWS Config configuration history addresses the separate need to review AWS resource configuration changes and compliance state because config records supported resource configurations and evaluates them against configuration rules; it is not as direct as AWS Trusted Advisor security checks for the actual requirement to review common security and configuration recommendations in AWS accounts.

AWS Organizations SCP addresses the separate need to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; it is not as direct as AWS Trusted Advisor security checks for the actual requirement to review common security and configuration recommendations in AWS accounts.