AWS global network infrastructure primarily supports the earlier need to determine who operates the provider-owned physical networking fabric because AWS manages its worldwide network infrastructure and physical connectivity within its facilities, but the new task is to identify who operates the physical and service infrastructure for Lambda execution; that is why AWS Lambda compute platform is preferable here.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to identify who operates the physical and service infrastructure for Lambda execution, which calls for AWS Lambda compute platform rather than Customer application patching on EC2 or the earlier AWS global network infrastructure.

Customer RDS access controls is intended to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used; in this design the new outcome is to identify who operates the physical and service infrastructure for Lambda execution, which calls for AWS Lambda compute platform rather than Customer RDS access controls or the earlier AWS global network infrastructure.

AWS WAF web request filtering addresses the separate need to filter HTTP and HTTPS requests reaching supported applications because wAF applies web access control rules against traffic patterns such as malicious requests; it is not as direct as AWS Shield DDoS protection for the actual requirement to reduce the effect of distributed denial-of-service attacks on supported applications.

Separation of duties addresses the separate need to prevent one principal from controlling incompatible business functions because splitting sensitive privileges among roles reduces misuse and accidental changes; it is not as direct as AWS Shield DDoS protection for the actual requirement to reduce the effect of distributed denial-of-service attacks on supported applications.

Amazon CloudWatch metrics addresses the separate need to observe resource utilization and service performance over time because cloudWatch gathers metrics, alarms and logs for operational monitoring; it is not as direct as AWS Shield DDoS protection for the actual requirement to reduce the effect of distributed denial-of-service attacks on supported applications.

AWS CloudTrail primarily supports the earlier need to investigate account actions and API activity relevant to a security event because cloudTrail supplies audit records of supported management events, but the new task is to find AWS security resources and information in one place; that is why AWS Security Center is preferable here.

AWS Security Hub is intended to review centralized security posture and findings from multiple sources because security Hub consolidates and prioritizes findings across AWS security services; in this design the new outcome is to find AWS security resources and information in one place, which calls for AWS Security Center rather than AWS Security Hub or the earlier AWS CloudTrail.

AWS Shield Standard is intended to provide baseline DDoS protections for supported AWS resources because shield Standard supplies automatic DDoS protection to supported resources; in this design the new outcome is to find AWS security resources and information in one place, which calls for AWS Security Center rather than AWS Shield Standard or the earlier AWS CloudTrail.

AWS physical data-center security primarily supports the earlier need to identify who protects buildings, hardware and physical facilities because AWS controls physical access, environmental safeguards and infrastructure facilities supporting its services, but the new task is to determine who operates the provider-owned physical networking fabric; that is why AWS global network infrastructure is preferable here.

AWS S3 infrastructure availability is intended to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; in this design the new outcome is to determine who operates the provider-owned physical networking fabric, which calls for AWS global network infrastructure rather than AWS S3 infrastructure availability or the earlier AWS physical data-center security.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to determine who operates the provider-owned physical networking fabric, which calls for AWS global network infrastructure rather than Customer EC2 guest OS patching or the earlier AWS physical data-center security.

IAM resource-based policy addresses a different objective, to grant access through a policy attached to a supported resource, because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; the checklist instead requires the distinct outcomes to support sign-up and authentication of application end users; set complexity and lifetime requirements for applicable IAM user passwords; define which AWS operations a successfully assumed role can perform.

Amazon Cognito identity pools addresses a different objective, to provide AWS credentials to application users using supported identities, because cognito identity pools exchange supported authentication for temporary AWS credentials; the checklist instead requires the distinct outcomes to support sign-up and authentication of application end users; set complexity and lifetime requirements for applicable IAM user passwords; define which AWS operations a successfully assumed role can perform.

IAM credential report addresses a different objective, to audit account IAM user credentials and their usage properties, because IAM credential reports summarize credential status for IAM users in an account; the checklist instead requires the distinct outcomes to support sign-up and authentication of application end users; set complexity and lifetime requirements for applicable IAM user passwords; define which AWS operations a successfully assumed role can perform.

That description belongs to AWS Shield Standard because shield Standard supplies automatic DDoS protection to supported resources; it is used to provide baseline DDoS protections for supported AWS resources, not to explain how AWS Secrets Manager provides the function to securely store supported credentials and coordinate secret rotation.

That description belongs to Amazon Inspector because inspector identifies vulnerability and exposure findings for covered resources; it is used to assess supported workloads for exploitable software weaknesses, not to explain how AWS Secrets Manager provides the function to securely store supported credentials and coordinate secret rotation.

That description belongs to AWS Config because config maintains resource configuration history and compliance evaluations; it is used to identify changes in supported AWS resource settings over time, not to explain how AWS Secrets Manager provides the function to securely store supported credentials and coordinate secret rotation.

Cross-account role assumption primarily supports the earlier need to allow a principal in one AWS account to gain defined temporary permissions in another because a cross-account role requires suitable trust and permission configuration, but the new task is to delegate service-specific operations to an AWS service under a defined role; that is why Service-linked IAM role is preferable here.

Permission sets for account assignments is intended to standardize workforce role assignments across multiple AWS accounts because IAM Identity Center permission sets help define permissions provisioned for assigned users or groups; in this design the new outcome is to delegate service-specific operations to an AWS service under a defined role, which calls for Service-linked IAM role rather than Permission sets for account assignments or the earlier Cross-account role assumption.

IAM permissions boundary is intended to limit the maximum permissions an identity policy can grant to a user or role because a permissions boundary acts as a ceiling on effective identity-based permissions; in this design the new outcome is to delegate service-specific operations to an AWS service under a defined role, which calls for Service-linked IAM role rather than IAM permissions boundary or the earlier Cross-account role assumption.

Customer application patching on EC2 addresses a different objective, to determine who updates software installed by a customer on an EC2 VM, because the customer is responsible for custom code and software installed on its virtual machines; the checklist instead requires the distinct outcomes to decide who enables appropriate activity logging and keeps records as required; recognize how patch duties differ between provider hosts and customer-managed instances.

Customer EC2 security groups addresses a different objective, to decide who configures firewall rules around a customer instance, because customers choose inbound and outbound security-group permissions for their resources; the checklist instead requires the distinct outcomes to decide who enables appropriate activity logging and keeps records as required; recognize how patch duties differ between provider hosts and customer-managed instances.

Customer VPC network design addresses a different objective, to determine who selects subnets, routes and exposure within a VPC, because customers design and configure their isolated network environment on AWS; the checklist instead requires the distinct outcomes to decide who enables appropriate activity logging and keeps records as required; recognize how patch duties differ between provider hosts and customer-managed instances.

AWS Resource Access Manager sharing primarily supports the earlier need to share supported AWS resources across accounts in a controlled way because AWS RAM enables supported resource sharing with eligible accounts or organizations, but the new task is to find unintended external or broad permissions on AWS resources; that is why Access analysis is preferable here.

Amazon VPC Flow Logs traffic metadata is intended to record selected IP network-flow information for VPC resources because VPC Flow Logs capture metadata about accepted or rejected traffic at supported interfaces; in this design the new outcome is to find unintended external or broad permissions on AWS resources, which calls for Access analysis rather than Amazon VPC Flow Logs traffic metadata or the earlier AWS Resource Access Manager sharing.

AWS Organizations SCP is intended to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; in this design the new outcome is to find unintended external or broad permissions on AWS resources, which calls for Access analysis rather than AWS Organizations SCP or the earlier AWS Resource Access Manager sharing.

AWS Marketplace security solutions is intended to obtain eligible third-party security software through AWS Marketplace because marketplace offers third-party and AWS software listings for procurement and deployment; in this design the new outcome is to retrieve third-party compliance reports relevant to AWS-operated controls, which calls for AWS Artifact rather than AWS Marketplace security solutions or the earlier AWS CloudTrail.

AWS WAF managed rule groups is intended to apply common web-request protection patterns using maintained rules because managed rule groups provide ready-to-use WAF rules for supported web endpoints; in this design the new outcome is to retrieve third-party compliance reports relevant to AWS-operated controls, which calls for AWS Artifact rather than AWS WAF managed rule groups or the earlier AWS CloudTrail.

AWS CloudTrail primarily supports the earlier need to investigate account actions and API activity relevant to a security event because cloudTrail supplies audit records of supported management events, but the new task is to retrieve third-party compliance reports relevant to AWS-operated controls; that is why AWS Artifact is preferable here.

Encryption at rest primarily supports the earlier need to protect information stored on disks or in object services because storage encryption helps keep persisted data protected against unauthorized disclosure, but the new task is to use customer-controlled single-tenant hardware security modules for key workloads; that is why AWS CloudHSM dedicated HSMs is preferable here.

AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to use customer-controlled single-tenant hardware security modules for key workloads, which calls for AWS CloudHSM dedicated HSMs rather than AWS Security Hub centralized findings or the earlier Encryption at rest.

AWS Trusted Advisor security checks is intended to review common security and configuration recommendations in AWS accounts because trusted Advisor offers checks and guidance across areas including security and cost; in this design the new outcome is to use customer-controlled single-tenant hardware security modules for key workloads, which calls for AWS CloudHSM dedicated HSMs rather than AWS Trusted Advisor security checks or the earlier Encryption at rest.