AWS Firewall Manager centralized policies primarily supports the earlier need to apply supported firewall protections consistently across multiple AWS accounts because firewall Manager provides central policy management for protections such as WAF and Shield-related configurations, but the new task is to identify departures from approved secure configuration baselines; that is why Security posture evaluation is preferable here.

AWS Config rules is intended to evaluate a configuration against a defined compliance requirement because config rules assess resource settings such as encryption or approved configuration states; in this design the new outcome is to identify departures from approved secure configuration baselines, which calls for Security posture evaluation rather than AWS Config rules or the earlier AWS Firewall Manager centralized policies.

AWS Config configuration history is intended to review AWS resource configuration changes and compliance state because config records supported resource configurations and evaluates them against configuration rules; in this design the new outcome is to identify departures from approved secure configuration baselines, which calls for Security posture evaluation rather than AWS Config configuration history or the earlier AWS Firewall Manager centralized policies.

AWS managed RDS infrastructure addresses the separate need to identify who handles the underlying operating system for an Amazon RDS DB instance because AWS operates the managed database platform and underlying host maintenance for RDS; it is not as direct as AWS S3 infrastructure availability for the actual requirement to identify who maintains the infrastructure used to operate Amazon S3.

Customer EC2 security groups addresses the separate need to decide who configures firewall rules around a customer instance because customers choose inbound and outbound security-group permissions for their resources; it is not as direct as AWS S3 infrastructure availability for the actual requirement to identify who maintains the infrastructure used to operate Amazon S3.

AWS hypervisor maintenance addresses the separate need to identify who maintains the virtualization host beneath an EC2 instance because AWS manages the host operating environment and virtualization components for EC2; it is not as direct as AWS S3 infrastructure availability for the actual requirement to identify who maintains the infrastructure used to operate Amazon S3.

AWS Lambda compute platform addresses the separate need to identify who operates the physical and service infrastructure for Lambda execution because AWS runs and scales the underlying Lambda compute service and manages its infrastructure; it is not as direct as AWS S3 infrastructure availability for the actual requirement to identify who maintains the infrastructure used to operate Amazon S3.

Temporary session credentials is intended to avoid long-lived application secrets when making authorized AWS requests because temporary credentials expire and can be issued through IAM roles and federation; in this design the new outcome is to support sign-up and authentication of application end users, which calls for Amazon Cognito user pools rather than Temporary session credentials or the earlier Multi-factor authentication (MFA).

Federated identity access is intended to let an existing external identity provider authenticate users for AWS access because federation allows trusted identities to receive AWS access without separate IAM user passwords; in this design the new outcome is to support sign-up and authentication of application end users, which calls for Amazon Cognito user pools rather than Federated identity access or the earlier Multi-factor authentication (MFA).

Multi-factor authentication (MFA) primarily supports the earlier need to add a second authentication factor to protect interactive sign-in because mFA requires an additional factor beyond a password or equivalent first credential, but the new task is to support sign-up and authentication of application end users; that is why Amazon Cognito user pools is preferable here.

AWS Config rules addresses the separate need to evaluate a configuration against a defined compliance requirement because config rules assess resource settings such as encryption or approved configuration states; it is not as direct as AWS Firewall Manager centralized policies for the actual requirement to apply supported firewall protections consistently across multiple AWS accounts.

AWS CloudHSM dedicated HSMs addresses the separate need to use customer-controlled single-tenant hardware security modules for key workloads because cloudHSM offers dedicated HSM capacity for supported cryptographic applications; it is not as direct as AWS Firewall Manager centralized policies for the actual requirement to apply supported firewall protections consistently across multiple AWS accounts.

Encryption at rest addresses the separate need to protect information stored on disks or in object services because storage encryption helps keep persisted data protected against unauthorized disclosure; it is not as direct as AWS Firewall Manager centralized policies for the actual requirement to apply supported firewall protections consistently across multiple AWS accounts.

AWS Security Lake centralized security data addresses the separate need to collect security logs in an analyzable data lake because security Lake can centralize supported security event and log data for analysis; it is not as direct as AWS Firewall Manager centralized policies for the actual requirement to apply supported firewall protections consistently across multiple AWS accounts.

Amazon Macie sensitive-data discovery addresses the separate need to locate sensitive information such as personal data in Amazon S3 because macie uses machine learning and pattern matching to discover sensitive data in S3; it is not as direct as AWS Firewall Manager centralized policies for the actual requirement to apply supported firewall protections consistently across multiple AWS accounts.

That description belongs to AWS hypervisor maintenance because AWS manages the host operating environment and virtualization components for EC2; it is used to identify who maintains the virtualization host beneath an EC2 instance, not to explain how Customer EC2 security groups provides the function to decide who configures firewall rules around a customer instance.

That description belongs to Customer IAM permission design because customers create access rules and identities suited to organizational least-privilege requirements; it is used to decide who grants access permissions to customer data and AWS resources, not to explain how Customer EC2 security groups provides the function to decide who configures firewall rules around a customer instance.

That description belongs to Customer application patching on EC2 because the customer is responsible for custom code and software installed on its virtual machines; it is used to determine who updates software installed by a customer on an EC2 VM, not to explain how Customer EC2 security groups provides the function to decide who configures firewall rules around a customer instance.

That description belongs to AWS Shield Standard because shield Standard supplies automatic DDoS protection to supported resources; it is used to provide baseline DDoS protections for supported AWS resources, not to explain how Amazon Inspector provides the function to assess supported workloads for exploitable software weaknesses.

That description belongs to AWS Config because config maintains resource configuration history and compliance evaluations; it is used to identify changes in supported AWS resource settings over time, not to explain how Amazon Inspector provides the function to assess supported workloads for exploitable software weaknesses.

That description belongs to AWS Secrets Manager because secrets Manager reduces the need to embed passwords and tokens in application source code; it is used to securely store supported credentials and coordinate secret rotation, not to explain how Amazon Inspector provides the function to assess supported workloads for exploitable software weaknesses.

That description belongs to IAM group because an IAM group is a collection of IAM users that can share attached permissions policies; it is used to manage similar IAM user permissions through group membership, not to explain how Multi-factor authentication (MFA) provides the function to add a second authentication factor to protect interactive sign-in.

That description belongs to IAM user because IAM users are identities defined within an AWS account with configurable permissions; it is used to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate, not to explain how Multi-factor authentication (MFA) provides the function to add a second authentication factor to protect interactive sign-in.

That description belongs to Amazon Cognito user pools because cognito user pools provide user directories and authentication features for apps; it is used to support sign-up and authentication of application end users, not to explain how Multi-factor authentication (MFA) provides the function to add a second authentication factor to protect interactive sign-in.

AWS Secrets Manager is intended to securely store supported credentials and coordinate secret rotation because secrets Manager reduces the need to embed passwords and tokens in application source code; in this design the new outcome is to detect external sharing and analyze access policies for supported resources, which calls for AWS IAM Access Analyzer rather than AWS Secrets Manager or the earlier Amazon Inspector.

AWS Security Center is intended to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; in this design the new outcome is to detect external sharing and analyze access policies for supported resources, which calls for AWS IAM Access Analyzer rather than AWS Security Center or the earlier Amazon Inspector.

Amazon Inspector primarily supports the earlier need to assess supported workloads for exploitable software weaknesses because inspector identifies vulnerability and exposure findings for covered resources, but the new task is to detect external sharing and analyze access policies for supported resources; that is why AWS IAM Access Analyzer is preferable here.

IAM user is intended to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions; in this design the new outcome is to use a predefined AWS-maintained permissions policy when its scope is appropriate, which calls for AWS managed IAM policies rather than IAM user or the earlier IAM policy condition.

IAM resource-based policy is intended to grant access through a policy attached to a supported resource because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; in this design the new outcome is to use a predefined AWS-maintained permissions policy when its scope is appropriate, which calls for AWS managed IAM policies rather than IAM resource-based policy or the earlier IAM policy condition.

IAM policy condition primarily supports the earlier need to limit authorized requests using context such as MFA, source or tags where supported because IAM policy conditions refine when an allow or deny statement applies, but the new task is to use a predefined AWS-maintained permissions policy when its scope is appropriate; that is why AWS managed IAM policies is preferable here.

That description belongs to Customer VPC network design because customers design and configure their isolated network environment on AWS; it is used to determine who selects subnets, routes and exposure within a VPC, not to explain how Customer backup policy selection provides the function to determine who chooses recovery retention and frequency for business workloads.

That description belongs to AWS global network infrastructure because AWS manages its worldwide network infrastructure and physical connectivity within its facilities; it is used to determine who operates the provider-owned physical networking fabric, not to explain how Customer backup policy selection provides the function to determine who chooses recovery retention and frequency for business workloads.

That description belongs to Customer application patching on EC2 because the customer is responsible for custom code and software installed on its virtual machines; it is used to determine who updates software installed by a customer on an EC2 VM, not to explain how Customer backup policy selection provides the function to determine who chooses recovery retention and frequency for business workloads.

Encryption at rest addresses a different objective, to protect information stored on disks or in object services, because storage encryption helps keep persisted data protected against unauthorized disclosure; the checklist instead requires the distinct outcomes to share supported AWS resources across accounts in a controlled way; review AWS resource configuration changes and compliance state.

AWS Certificate Manager TLS certificates addresses a different objective, to provision and manage certificates for supported TLS endpoints, because aCM manages public or imported certificates for use with integrated services; the checklist instead requires the distinct outcomes to share supported AWS resources across accounts in a controlled way; review AWS resource configuration changes and compliance state.

AWS Firewall Manager centralized policies addresses a different objective, to apply supported firewall protections consistently across multiple AWS accounts, because firewall Manager provides central policy management for protections such as WAF and Shield-related configurations; the checklist instead requires the distinct outcomes to share supported AWS resources across accounts in a controlled way; review AWS resource configuration changes and compliance state.