That description belongs to AWS Security Lake centralized security data because security Lake can centralize supported security event and log data for analysis; it is used to collect security logs in an analyzable data lake, not to explain how Data-residency region choice provides the function to select a deployment geography to meet an organization's data-location requirements.

That description belongs to Amazon Macie sensitive-data discovery because macie uses machine learning and pattern matching to discover sensitive data in S3; it is used to locate sensitive information such as personal data in Amazon S3, not to explain how Data-residency region choice provides the function to select a deployment geography to meet an organization's data-location requirements.

That description belongs to AWS Organizations SCP because service control policies limit the permissions available to principals in affected member accounts; it is used to establish maximum account permissions across an AWS organization, not to explain how Data-residency region choice provides the function to select a deployment geography to meet an organization's data-location requirements.

That description belongs to AWS WAF managed rule groups because managed rule groups provide ready-to-use WAF rules for supported web endpoints; it is used to apply common web-request protection patterns using maintained rules, not to explain how AWS KMS provides the function to manage cryptographic keys and their authorized use in AWS services.

That description belongs to AWS CloudHSM because cloudHSM provides dedicated hardware security modules for customer-managed keys and crypto operations; it is used to use dedicated hardware modules with direct cryptographic control, not to explain how AWS KMS provides the function to manage cryptographic keys and their authorized use in AWS services.

That description belongs to AWS Certificate Manager because aCM can provision and manage certificates used on supported encrypted endpoints; it is used to manage TLS certificates for integrated AWS applications, not to explain how AWS KMS provides the function to manage cryptographic keys and their authorized use in AWS services.

Customer S3 bucket policy addresses the separate need to decide who restricts public or cross-account access to stored objects because customers own S3 authorization configuration such as bucket policies and access settings; it is not as direct as Customer RDS access controls for the actual requirement to identify who sets database credentials and network exposure for an RDS workload.

Customer encryption configuration addresses the separate need to decide who chooses encryption settings and key access rules for customer information because customers select appropriate encryption options and configure permissions for data protection; it is not as direct as Customer RDS access controls for the actual requirement to identify who sets database credentials and network exposure for an RDS workload.

Customer data classification addresses the separate need to decide who labels business data by sensitivity before selecting controls because customers classify information and determine required access and protection levels; it is not as direct as Customer RDS access controls for the actual requirement to identify who sets database credentials and network exposure for an RDS workload.

Customer EC2 security groups addresses the separate need to decide who configures firewall rules around a customer instance because customers choose inbound and outbound security-group permissions for their resources; it is not as direct as Customer RDS access controls for the actual requirement to identify who sets database credentials and network exposure for an RDS workload.

AWS CloudTrail primarily supports the earlier need to investigate account actions and API activity relevant to a security event because cloudTrail supplies audit records of supported management events, but the new task is to investigate relationships and context around suspicious activity; that is why Amazon Detective is preferable here.

AWS WAF managed rule groups is intended to apply common web-request protection patterns using maintained rules because managed rule groups provide ready-to-use WAF rules for supported web endpoints; in this design the new outcome is to investigate relationships and context around suspicious activity, which calls for Amazon Detective rather than AWS WAF managed rule groups or the earlier AWS CloudTrail.

Amazon GuardDuty is intended to surface suspicious activity using threat intelligence and anomaly analysis because guardDuty detects potential security threats from supported AWS signals; in this design the new outcome is to investigate relationships and context around suspicious activity, which calls for Amazon Detective rather than Amazon GuardDuty or the earlier AWS CloudTrail.

That description belongs to Inline IAM policy because an inline policy maintains a one-to-one association with an IAM user, group or role; it is used to bind a permissions policy directly to one identity rather than sharing it, not to explain how IAM permissions boundary provides the function to limit the maximum permissions an identity policy can grant to a user or role.

That description belongs to AWS managed IAM policies because AWS managed policies are maintained by AWS and may change as services evolve; it is used to use a predefined AWS-maintained permissions policy when its scope is appropriate, not to explain how IAM permissions boundary provides the function to limit the maximum permissions an identity policy can grant to a user or role.

That description belongs to IAM resource-based policy because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; it is used to grant access through a policy attached to a supported resource, not to explain how IAM permissions boundary provides the function to limit the maximum permissions an identity policy can grant to a user or role.

AWS Artifact compliance reports is intended to obtain AWS third-party compliance reports and contractual documents because artifact provides self-service access to selected AWS compliance documentation and agreements; in this design the new outcome is to evaluate a configuration against a defined compliance requirement, which calls for AWS Config rules rather than AWS Artifact compliance reports or the earlier AWS Trusted Advisor security checks.

Security posture evaluation is intended to identify departures from approved secure configuration baselines because posture tools and configuration checks compare resource settings against security standards; in this design the new outcome is to evaluate a configuration against a defined compliance requirement, which calls for AWS Config rules rather than Security posture evaluation or the earlier AWS Trusted Advisor security checks.

AWS Trusted Advisor security checks primarily supports the earlier need to review common security and configuration recommendations in AWS accounts because trusted Advisor offers checks and guidance across areas including security and cost, but the new task is to evaluate a configuration against a defined compliance requirement; that is why AWS Config rules is preferable here.

AWS S3 infrastructure availability is intended to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; in this design the new outcome is to decide who configures firewall rules around a customer instance, which calls for Customer EC2 security groups rather than AWS S3 infrastructure availability or the earlier Customer encryption configuration.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to decide who configures firewall rules around a customer instance, which calls for Customer EC2 security groups rather than Customer EC2 guest OS patching or the earlier Customer encryption configuration.

Customer encryption configuration primarily supports the earlier need to decide who chooses encryption settings and key access rules for customer information because customers select appropriate encryption options and configure permissions for data protection, but the new task is to decide who configures firewall rules around a customer instance; that is why Customer EC2 security groups is preferable here.

That description belongs to Amazon Detective because detective helps security analysts explore activity and connected evidence; it is used to investigate relationships and context around suspicious activity, not to explain how Amazon GuardDuty provides the function to surface suspicious activity using threat intelligence and anomaly analysis.

That description belongs to AWS WAF managed rule groups because managed rule groups provide ready-to-use WAF rules for supported web endpoints; it is used to apply common web-request protection patterns using maintained rules, not to explain how Amazon GuardDuty provides the function to surface suspicious activity using threat intelligence and anomaly analysis.

That description belongs to AWS CloudTrail because cloudTrail supplies audit records of supported management events; it is used to investigate account actions and API activity relevant to a security event, not to explain how Amazon GuardDuty provides the function to surface suspicious activity using threat intelligence and anomaly analysis.

That description belongs to AWS regional facility redundancy because AWS builds and operates the physical infrastructure supporting Regions and AZs; it is used to identify who maintains the independent infrastructure underlying Availability Zones, not to explain how AWS hypervisor maintenance provides the function to identify who maintains the virtualization host beneath an EC2 instance.

That description belongs to AWS managed RDS infrastructure because AWS operates the managed database platform and underlying host maintenance for RDS; it is used to identify who handles the underlying operating system for an Amazon RDS DB instance, not to explain how AWS hypervisor maintenance provides the function to identify who maintains the virtualization host beneath an EC2 instance.

That description belongs to AWS physical data-center security because AWS controls physical access, environmental safeguards and infrastructure facilities supporting its services; it is used to identify who protects buildings, hardware and physical facilities, not to explain how AWS hypervisor maintenance provides the function to identify who maintains the virtualization host beneath an EC2 instance.

AWS Organizations SCP addresses the separate need to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; it is not as direct as AWS service compliance inheritance for the actual requirement to use AWS audited infrastructure controls as supporting evidence.

Amazon Macie sensitive-data discovery addresses the separate need to locate sensitive information such as personal data in Amazon S3 because macie uses machine learning and pattern matching to discover sensitive data in S3; it is not as direct as AWS service compliance inheritance for the actual requirement to use AWS audited infrastructure controls as supporting evidence.

AWS Firewall Manager centralized policies addresses the separate need to apply supported firewall protections consistently across multiple AWS accounts because firewall Manager provides central policy management for protections such as WAF and Shield-related configurations; it is not as direct as AWS service compliance inheritance for the actual requirement to use AWS audited infrastructure controls as supporting evidence.

IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to authorize programmatic AWS API access for a permitted IAM principal, which calls for IAM access keys rather than IAM Identity Center external directory or the earlier Password policy.

AWS Organizations member-account guardrails is intended to restrict maximum access by applying organizational policies because organization-level policies can constrain member accounts regardless of broader IAM allows; in this design the new outcome is to authorize programmatic AWS API access for a permitted IAM principal, which calls for IAM access keys rather than AWS Organizations member-account guardrails or the earlier Password policy.

Password policy primarily supports the earlier need to set complexity and lifetime requirements for applicable IAM user passwords because account password policy governs certain IAM user console passwords, but the new task is to authorize programmatic AWS API access for a permitted IAM principal; that is why IAM access keys is preferable here.