AWS managed IAM policies addresses the separate need to use a predefined AWS-maintained permissions policy when its scope is appropriate because AWS managed policies are maintained by AWS and may change as services evolve; it is not as direct as IAM Access Analyzer policy validation for the actual requirement to identify policy errors and security warnings before broad access is granted.

IAM permissions boundary addresses the separate need to limit the maximum permissions an identity policy can grant to a user or role because a permissions boundary acts as a ceiling on effective identity-based permissions; it is not as direct as IAM Access Analyzer policy validation for the actual requirement to identify policy errors and security warnings before broad access is granted.

IAM role permissions policy addresses the separate need to define which AWS operations a successfully assumed role can perform because permissions policies attached to a role determine allowed service actions within other policy limits; it is not as direct as IAM Access Analyzer policy validation for the actual requirement to identify policy errors and security warnings before broad access is granted.

AWS's physical infrastructure security does not automatically authorize only the desired business users; that caveat is associated more closely with Customer S3 bucket policy for the need to decide who restricts public or cross-account access to stored objects than with Customer logging and retention settings for the requirement to decide who enables appropriate activity logging and keeps records as required.

AWS cannot independently decide which customer records constitute confidential business data; that caveat is associated more closely with Customer data classification for the need to decide who labels business data by sensitivity before selecting controls than with Customer logging and retention settings for the requirement to decide who enables appropriate activity logging and keeps records as required.

AWS may operate cryptographic infrastructure, but the customer's authorization decisions remain important; that caveat is associated more closely with Customer encryption configuration for the need to decide who chooses encryption settings and key access rules for customer information than with Customer logging and retention settings for the requirement to decide who enables appropriate activity logging and keeps records as required.

AWS Config is intended to identify changes in supported AWS resource settings over time because config maintains resource configuration history and compliance evaluations; in this design the new outcome is to assess supported workloads for exploitable software weaknesses, which calls for Amazon Inspector rather than AWS Config or the earlier AWS Shield Standard.

AWS Secrets Manager is intended to securely store supported credentials and coordinate secret rotation because secrets Manager reduces the need to embed passwords and tokens in application source code; in this design the new outcome is to assess supported workloads for exploitable software weaknesses, which calls for Amazon Inspector rather than AWS Secrets Manager or the earlier AWS Shield Standard.

AWS Shield Standard primarily supports the earlier need to provide baseline DDoS protections for supported AWS resources because shield Standard supplies automatic DDoS protection to supported resources, but the new task is to assess supported workloads for exploitable software weaknesses; that is why Amazon Inspector is preferable here.

Customer S3 bucket policy is intended to decide who restricts public or cross-account access to stored objects because customers own S3 authorization configuration such as bucket policies and access settings; in this design the new outcome is to decide who labels business data by sensitivity before selecting controls, which calls for Customer data classification rather than Customer S3 bucket policy or the earlier Customer backup policy selection.

Customer encryption configuration is intended to decide who chooses encryption settings and key access rules for customer information because customers select appropriate encryption options and configure permissions for data protection; in this design the new outcome is to decide who labels business data by sensitivity before selecting controls, which calls for Customer data classification rather than Customer encryption configuration or the earlier Customer backup policy selection.

Customer backup policy selection primarily supports the earlier need to determine who chooses recovery retention and frequency for business workloads because customers establish data recovery objectives and configure suitable backups or managed-service settings, but the new task is to decide who labels business data by sensitivity before selecting controls; that is why Customer data classification is preferable here.

AWS Organizations SCP is intended to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; in this design the new outcome is to detect suspicious account or workload behavior from security signals, which calls for Amazon GuardDuty threat detection rather than AWS Organizations SCP or the earlier AWS CloudTrail event history.

AWS CloudTrail event history primarily supports the earlier need to review who invoked AWS management API actions in an account because cloudTrail records AWS account API activity and supports investigation of management actions, but the new task is to detect suspicious account or workload behavior from security signals; that is why Amazon GuardDuty threat detection is preferable here.

AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to detect suspicious account or workload behavior from security signals, which calls for Amazon GuardDuty threat detection rather than AWS Security Hub centralized findings or the earlier AWS CloudTrail event history.

Cross-account role assumption addresses the separate need to allow a principal in one AWS account to gain defined temporary permissions in another because a cross-account role requires suitable trust and permission configuration; it is not as direct as Multi-factor authentication (MFA) for the actual requirement to add a second authentication factor to protect interactive sign-in.

Amazon Cognito user pools addresses the separate need to support sign-up and authentication of application end users because cognito user pools provide user directories and authentication features for apps; it is not as direct as Multi-factor authentication (MFA) for the actual requirement to add a second authentication factor to protect interactive sign-in.

IAM access keys addresses the separate need to authorize programmatic AWS API access for a permitted IAM principal because an access key ID and secret key can sign API requests but require careful protection and rotation; it is not as direct as Multi-factor authentication (MFA) for the actual requirement to add a second authentication factor to protect interactive sign-in.

An investigation tool is not itself the primary mechanism for filtering web traffic; that caveat is associated more closely with Amazon Detective for the need to investigate relationships and context around suspicious activity than with Amazon GuardDuty for the requirement to surface suspicious activity using threat intelligence and anomaly analysis.

Activity records do not independently identify every software vulnerability; that caveat is associated more closely with AWS CloudTrail for the need to investigate account actions and API activity relevant to a security event than with Amazon GuardDuty for the requirement to surface suspicious activity using threat intelligence and anomaly analysis.

WAF filtering cannot correct a compromised IAM administrator account; that caveat is associated more closely with AWS WAF managed rule groups for the need to apply common web-request protection patterns using maintained rules than with Amazon GuardDuty for the requirement to surface suspicious activity using threat intelligence and anomaly analysis.

Security incident response planning primarily supports the earlier need to prepare containment, investigation and recovery processes before an incident because well-defined incident response combines people, procedures, monitoring and evidence retention, but the new task is to use customer-controlled single-tenant hardware security modules for key workloads; that is why AWS CloudHSM dedicated HSMs is preferable here.

AWS Trusted Advisor security checks is intended to review common security and configuration recommendations in AWS accounts because trusted Advisor offers checks and guidance across areas including security and cost; in this design the new outcome is to use customer-controlled single-tenant hardware security modules for key workloads, which calls for AWS CloudHSM dedicated HSMs rather than AWS Trusted Advisor security checks or the earlier Security incident response planning.

AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to use customer-controlled single-tenant hardware security modules for key workloads, which calls for AWS CloudHSM dedicated HSMs rather than AWS Security Hub centralized findings or the earlier Security incident response planning.

Root user credential protection is intended to reduce exposure of the AWS account's highly privileged root identity because AWS recommends protecting root credentials, enabling MFA and avoiding routine root use; in this design the new outcome is to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate, which calls for IAM user rather than Root user credential protection or the earlier Inline IAM policy.

Inline IAM policy primarily supports the earlier need to bind a permissions policy directly to one identity rather than sharing it because an inline policy maintains a one-to-one association with an IAM user, group or role, but the new task is to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate; that is why IAM user is preferable here.

IAM credential report is intended to audit account IAM user credentials and their usage properties because IAM credential reports summarize credential status for IAM users in an account; in this design the new outcome is to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate, which calls for IAM user rather than IAM credential report or the earlier Inline IAM policy.

AWS CloudHSM primarily supports the earlier need to use dedicated hardware modules with direct cryptographic control because cloudHSM provides dedicated hardware security modules for customer-managed keys and crypto operations, but the new task is to manage cryptographic keys and their authorized use in AWS services; that is why AWS KMS is preferable here.

AWS WAF managed rule groups is intended to apply common web-request protection patterns using maintained rules because managed rule groups provide ready-to-use WAF rules for supported web endpoints; in this design the new outcome is to manage cryptographic keys and their authorized use in AWS services, which calls for AWS KMS rather than AWS WAF managed rule groups or the earlier AWS CloudHSM.

AWS Certificate Manager is intended to manage TLS certificates for integrated AWS applications because aCM can provision and manage certificates used on supported encrypted endpoints; in this design the new outcome is to manage cryptographic keys and their authorized use in AWS services, which calls for AWS KMS rather than AWS Certificate Manager or the earlier AWS CloudHSM.

AWS global network infrastructure primarily supports the earlier need to determine who operates the provider-owned physical networking fabric because AWS manages its worldwide network infrastructure and physical connectivity within its facilities, but the new task is to identify who operates the physical and service infrastructure for Lambda execution; that is why AWS Lambda compute platform is preferable here.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to identify who operates the physical and service infrastructure for Lambda execution, which calls for AWS Lambda compute platform rather than Customer application patching on EC2 or the earlier AWS global network infrastructure.

Customer RDS access controls is intended to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used; in this design the new outcome is to identify who operates the physical and service infrastructure for Lambda execution, which calls for AWS Lambda compute platform rather than Customer RDS access controls or the earlier AWS global network infrastructure.