Encryption at rest primarily supports the earlier need to protect information stored on disks or in object services because storage encryption helps keep persisted data protected against unauthorized disclosure, but the new task is to use customer-controlled single-tenant hardware security modules for key workloads; that is why AWS CloudHSM dedicated HSMs is preferable here.

AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to use customer-controlled single-tenant hardware security modules for key workloads, which calls for AWS CloudHSM dedicated HSMs rather than AWS Security Hub centralized findings or the earlier Encryption at rest.

AWS Trusted Advisor security checks is intended to review common security and configuration recommendations in AWS accounts because trusted Advisor offers checks and guidance across areas including security and cost; in this design the new outcome is to use customer-controlled single-tenant hardware security modules for key workloads, which calls for AWS CloudHSM dedicated HSMs rather than AWS Trusted Advisor security checks or the earlier Encryption at rest.

Customer Lambda function code primarily supports the earlier need to identify who writes and secures the application logic of a Lambda function because customers own the code, dependencies and identity permissions they provide to a Lambda function, but the new task is to identify who sets database credentials and network exposure for an RDS workload; that is why Customer RDS access controls is preferable here.

AWS hypervisor maintenance is intended to identify who maintains the virtualization host beneath an EC2 instance because AWS manages the host operating environment and virtualization components for EC2; in this design the new outcome is to identify who sets database credentials and network exposure for an RDS workload, which calls for Customer RDS access controls rather than AWS hypervisor maintenance or the earlier Customer Lambda function code.

AWS Lambda compute platform is intended to identify who operates the physical and service infrastructure for Lambda execution because AWS runs and scales the underlying Lambda compute service and manages its infrastructure; in this design the new outcome is to identify who sets database credentials and network exposure for an RDS workload, which calls for Customer RDS access controls rather than AWS Lambda compute platform or the earlier Customer Lambda function code.

IAM role permissions policy addresses the separate need to define which AWS operations a successfully assumed role can perform because permissions policies attached to a role determine allowed service actions within other policy limits; it is not as direct as Implicit deny default for the actual requirement to understand why a principal cannot act without an applicable permission.

Amazon Cognito identity pools addresses the separate need to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; it is not as direct as Implicit deny default for the actual requirement to understand why a principal cannot act without an applicable permission.

Explicit deny precedence addresses the separate need to ensure a denied API action cannot be overridden by another allow statement because an applicable explicit deny in AWS authorization evaluation overrides applicable allows; it is not as direct as Implicit deny default for the actual requirement to understand why a principal cannot act without an applicable permission.

AWS Systems Manager Parameter Store addresses the separate need to store configuration parameters and selected secrets for applications because parameter Store provides hierarchical parameter values with access controlled through IAM; it is not as direct as Implicit deny default for the actual requirement to understand why a principal cannot act without an applicable permission.

That description belongs to Permission sets for account assignments because IAM Identity Center permission sets help define permissions provisioned for assigned users or groups; it is used to standardize workforce role assignments across multiple AWS accounts, not to explain how IAM role trust policy provides the function to define which principals are allowed to assume a specific role.

That description belongs to IAM role permissions policy because permissions policies attached to a role determine allowed service actions within other policy limits; it is used to define which AWS operations a successfully assumed role can perform, not to explain how IAM role trust policy provides the function to define which principals are allowed to assume a specific role.

That description belongs to Service-linked IAM role because service-linked roles are tied to AWS services and have constrained predefined service purposes; it is used to delegate service-specific operations to an AWS service under a defined role, not to explain how IAM role trust policy provides the function to define which principals are allowed to assume a specific role.

AWS Artifact addresses the separate need to retrieve third-party compliance reports relevant to AWS-operated controls because artifact makes AWS assurance materials accessible for compliance teams; it is not as direct as AWS Trusted Advisor for the actual requirement to review common security and configuration opportunities alongside operational checks.

AWS Firewall Manager addresses the separate need to apply common web and network protection policies across accounts because firewall Manager helps centrally deploy supported security protections; it is not as direct as AWS Trusted Advisor for the actual requirement to review common security and configuration opportunities alongside operational checks.

AWS Security Hub addresses the separate need to review centralized security posture and findings from multiple sources because security Hub consolidates and prioritizes findings across AWS security services; it is not as direct as AWS Trusted Advisor for the actual requirement to review common security and configuration opportunities alongside operational checks.

Database platform management does not decide which application users deserve access; that caveat is associated more closely with Customer RDS access controls for the need to identify who sets database credentials and network exposure for an RDS workload than with AWS hypervisor maintenance for the requirement to identify who maintains the virtualization host beneath an EC2 instance.

Customers configure their VPC routing, gateways and allowed traffic; that caveat is associated more closely with AWS global network infrastructure for the need to determine who operates the provider-owned physical networking fabric than with AWS hypervisor maintenance for the requirement to identify who maintains the virtualization host beneath an EC2 instance.

Using EC2 does not transfer guest-level operating-system upkeep to AWS; that caveat is associated more closely with Customer EC2 guest OS patching for the need to determine who installs security updates inside a customer-managed EC2 operating system than with AWS hypervisor maintenance for the requirement to identify who maintains the virtualization host beneath an EC2 instance.

KMS key policies do not decide which data is personally identifiable; that caveat is associated more closely with AWS KMS managed keys for the need to control encryption keys for supported AWS integrated services than with AWS Shield DDoS protection for the requirement to reduce the effect of distributed denial-of-service attacks on supported applications.

A CPU chart alone cannot prove which IAM principal called a control-plane API; that caveat is associated more closely with Amazon CloudWatch metrics for the need to observe resource utilization and service performance over time than with AWS Shield DDoS protection for the requirement to reduce the effect of distributed denial-of-service attacks on supported applications.

Certificate management is distinct from encrypting database files at rest; that caveat is associated more closely with AWS Certificate Manager TLS certificates for the need to provision and manage certificates for supported TLS endpoints than with AWS Shield DDoS protection for the requirement to reduce the effect of distributed denial-of-service attacks on supported applications.

Amazon Inspector is intended to assess supported workloads for exploitable software weaknesses because inspector identifies vulnerability and exposure findings for covered resources; in this design the new outcome is to provide baseline DDoS protections for supported AWS resources, which calls for AWS Shield Standard rather than Amazon Inspector or the earlier AWS Security Center.

AWS Security Center primarily supports the earlier need to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities, but the new task is to provide baseline DDoS protections for supported AWS resources; that is why AWS Shield Standard is preferable here.

AWS Secrets Manager is intended to securely store supported credentials and coordinate secret rotation because secrets Manager reduces the need to embed passwords and tokens in application source code; in this design the new outcome is to provide baseline DDoS protections for supported AWS resources, which calls for AWS Shield Standard rather than AWS Secrets Manager or the earlier AWS Security Center.

AWS Config configuration history is intended to review AWS resource configuration changes and compliance state because config records supported resource configurations and evaluates them against configuration rules; in this design the new outcome is to observe resource utilization and service performance over time, which calls for Amazon CloudWatch metrics rather than AWS Config configuration history or the earlier AWS Resource Access Manager sharing.

Encryption in transit is intended to protect information while it travels over a network because tLS and similar protocols help secure data exchanged between clients and services; in this design the new outcome is to observe resource utilization and service performance over time, which calls for Amazon CloudWatch metrics rather than Encryption in transit or the earlier AWS Resource Access Manager sharing.

AWS Resource Access Manager sharing primarily supports the earlier need to share supported AWS resources across accounts in a controlled way because AWS RAM enables supported resource sharing with eligible accounts or organizations, but the new task is to observe resource utilization and service performance over time; that is why Amazon CloudWatch metrics is preferable here.

Cross-account role assumption addresses the separate need to allow a principal in one AWS account to gain defined temporary permissions in another because a cross-account role requires suitable trust and permission configuration; it is not as direct as Principle of least privilege for the actual requirement to give each identity only the access needed to do its assigned work.

IAM role temporary credentials addresses the separate need to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; it is not as direct as Principle of least privilege for the actual requirement to give each identity only the access needed to do its assigned work.

IAM group addresses the separate need to manage similar IAM user permissions through group membership because an IAM group is a collection of IAM users that can share attached permissions policies; it is not as direct as Principle of least privilege for the actual requirement to give each identity only the access needed to do its assigned work.

Customer EC2 security groups primarily supports the earlier need to decide who configures firewall rules around a customer instance because customers choose inbound and outbound security-group permissions for their resources, but the new task is to decide who labels business data by sensitivity before selecting controls; that is why Customer data classification is preferable here.

Customer encryption configuration is intended to decide who chooses encryption settings and key access rules for customer information because customers select appropriate encryption options and configure permissions for data protection; in this design the new outcome is to decide who labels business data by sensitivity before selecting controls, which calls for Customer data classification rather than Customer encryption configuration or the earlier Customer EC2 security groups.

Customer S3 bucket policy is intended to decide who restricts public or cross-account access to stored objects because customers own S3 authorization configuration such as bucket policies and access settings; in this design the new outcome is to decide who labels business data by sensitivity before selecting controls, which calls for Customer data classification rather than Customer S3 bucket policy or the earlier Customer EC2 security groups.