Customer EC2 security groups primarily supports the earlier need to decide who configures firewall rules around a customer instance because customers choose inbound and outbound security-group permissions for their resources, but the new task is to decide who labels business data by sensitivity before selecting controls; that is why Customer data classification is preferable here.

Customer encryption configuration is intended to decide who chooses encryption settings and key access rules for customer information because customers select appropriate encryption options and configure permissions for data protection; in this design the new outcome is to decide who labels business data by sensitivity before selecting controls, which calls for Customer data classification rather than Customer encryption configuration or the earlier Customer EC2 security groups.

Customer S3 bucket policy is intended to decide who restricts public or cross-account access to stored objects because customers own S3 authorization configuration such as bucket policies and access settings; in this design the new outcome is to decide who labels business data by sensitivity before selecting controls, which calls for Customer data classification rather than Customer S3 bucket policy or the earlier Customer EC2 security groups.

A key is not an identity group that grants all application permissions; that caveat is associated more closely with AWS KMS for the need to manage cryptographic keys and their authorized use in AWS services than with AWS Certificate Manager for the requirement to manage TLS certificates for integrated AWS applications.

WAF filtering cannot correct a compromised IAM administrator account; that caveat is associated more closely with AWS WAF managed rule groups for the need to apply common web-request protection patterns using maintained rules than with AWS Certificate Manager for the requirement to manage TLS certificates for integrated AWS applications.

It does not promise all advanced response services of paid enhanced offerings; that caveat is associated more closely with AWS Shield Standard for the need to provide baseline DDoS protections for supported AWS resources than with AWS Certificate Manager for the requirement to manage TLS certificates for integrated AWS applications.

Credential rotation primarily supports the earlier need to reduce risk when long-lived programmatic secrets must be retained because rotating access keys and other secrets limits the lifetime of exposed credentials, but the new task is to avoid long-lived application secrets when making authorized AWS requests; that is why Temporary session credentials is preferable here.

AWS Secrets Manager is intended to store and rotate supported application secrets without hard-coding them because secrets Manager stores protected secrets and supports rotation workflows; in this design the new outcome is to avoid long-lived application secrets when making authorized AWS requests, which calls for Temporary session credentials rather than AWS Secrets Manager or the earlier Credential rotation.

IAM policy condition is intended to limit authorized requests using context such as MFA, source or tags where supported because IAM policy conditions refine when an allow or deny statement applies; in this design the new outcome is to avoid long-lived application secrets when making authorized AWS requests, which calls for Temporary session credentials rather than IAM policy condition or the earlier Credential rotation.

Customer EC2 guest OS patching addresses a different objective, to determine who installs security updates inside a customer-managed EC2 operating system, because customers maintain the guest OS, including relevant patches, configuration and hardening; the checklist instead requires the distinct outcomes to identify who writes and secures the application logic of a Lambda function; recognize how patch duties differ between provider hosts and customer-managed instances.

Customer VPC network design addresses a different objective, to determine who selects subnets, routes and exposure within a VPC, because customers design and configure their isolated network environment on AWS; the checklist instead requires the distinct outcomes to identify who writes and secures the application logic of a Lambda function; recognize how patch duties differ between provider hosts and customer-managed instances.

AWS S3 infrastructure availability addresses a different objective, to identify who maintains the infrastructure used to operate Amazon S3, because AWS manages the underlying hardware, facilities and service platform for S3; the checklist instead requires the distinct outcomes to identify who writes and secures the application logic of a Lambda function; recognize how patch duties differ between provider hosts and customer-managed instances.

AWS CloudHSM dedicated HSMs addresses a different objective, to use customer-controlled single-tenant hardware security modules for key workloads, because cloudHSM offers dedicated HSM capacity for supported cryptographic applications; the checklist instead requires the distinct outcomes to retain and correlate audit records from multiple accounts; collect security logs in an analyzable data lake.

Amazon GuardDuty threat detection addresses a different objective, to detect suspicious account or workload behavior from security signals, because guardDuty analyzes supported event and telemetry sources to identify potential malicious activity; the checklist instead requires the distinct outcomes to retain and correlate audit records from multiple accounts; collect security logs in an analyzable data lake.

Access analysis addresses a different objective, to find unintended external or broad permissions on AWS resources, because IAM Access Analyzer can help identify supported resources shared with external principals and analyze access; the checklist instead requires the distinct outcomes to retain and correlate audit records from multiple accounts; collect security logs in an analyzable data lake.

That description belongs to Federated identity access because federation allows trusted identities to receive AWS access without separate IAM user passwords; it is used to let an existing external identity provider authenticate users for AWS access, not to explain how Principle of least privilege provides the function to give each identity only the access needed to do its assigned work.

That description belongs to IAM role temporary credentials because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; it is used to provide temporary access to a trusted principal or AWS workload, not to explain how Principle of least privilege provides the function to give each identity only the access needed to do its assigned work.

That description belongs to AWS Organizations member-account guardrails because organization-level policies can constrain member accounts regardless of broader IAM allows; it is used to restrict maximum access by applying organizational policies, not to explain how Principle of least privilege provides the function to give each identity only the access needed to do its assigned work.

It is reference material, not a log collection service; that caveat is associated more closely with AWS Knowledge Center for the need to find answers to common AWS technical and security questions than with AWS WAF managed rule groups for the requirement to apply common web-request protection patterns using maintained rules.

Its check coverage differs from dedicated attack-detection tools; that caveat is associated more closely with AWS Trusted Advisor for the need to review common security and configuration opportunities alongside operational checks than with AWS WAF managed rule groups for the requirement to apply common web-request protection patterns using maintained rules.

It does not promise all advanced response services of paid enhanced offerings; that caveat is associated more closely with AWS Shield Standard for the need to provide baseline DDoS protections for supported AWS resources than with AWS WAF managed rule groups for the requirement to apply common web-request protection patterns using maintained rules.

Customer data classification is intended to decide who labels business data by sensitivity before selecting controls because customers classify information and determine required access and protection levels; in this design the new outcome is to determine who ensures application use and data handling meet the customer's regulations, which calls for Customer compliance obligations rather than Customer data classification or the earlier Customer VPC network design.

Customer encryption configuration is intended to decide who chooses encryption settings and key access rules for customer information because customers select appropriate encryption options and configure permissions for data protection; in this design the new outcome is to determine who ensures application use and data handling meet the customer's regulations, which calls for Customer compliance obligations rather than Customer encryption configuration or the earlier Customer VPC network design.

Customer VPC network design primarily supports the earlier need to determine who selects subnets, routes and exposure within a VPC because customers design and configure their isolated network environment on AWS, but the new task is to determine who ensures application use and data handling meet the customer's regulations; that is why Customer compliance obligations is preferable here.

Storing events does not inherently block malicious network traffic; that caveat is associated more closely with AWS Security Lake centralized security data for the need to collect security logs in an analyzable data lake than with Data-residency region choice for the requirement to select a deployment geography to meet an organization's data-location requirements.

It is not a general-purpose EC2 malware scanner; that caveat is associated more closely with Amazon Macie sensitive-data discovery for the need to locate sensitive information such as personal data in Amazon S3 than with Data-residency region choice for the requirement to select a deployment geography to meet an organization's data-location requirements.

SCPs do not grant permissions on their own; IAM must allow the desired operation; that caveat is associated more closely with AWS Organizations SCP for the need to establish maximum account permissions across an AWS organization than with Data-residency region choice for the requirement to select a deployment geography to meet an organization's data-location requirements.

Customer EC2 security groups is intended to decide who configures firewall rules around a customer instance because customers choose inbound and outbound security-group permissions for their resources; in this design the new outcome is to identify who maintains the infrastructure used to operate Amazon S3, which calls for AWS S3 infrastructure availability rather than Customer EC2 security groups or the earlier AWS hypervisor maintenance.

AWS hypervisor maintenance primarily supports the earlier need to identify who maintains the virtualization host beneath an EC2 instance because AWS manages the host operating environment and virtualization components for EC2, but the new task is to identify who maintains the infrastructure used to operate Amazon S3; that is why AWS S3 infrastructure availability is preferable here.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to identify who maintains the infrastructure used to operate Amazon S3, which calls for AWS S3 infrastructure availability rather than Customer application patching on EC2 or the earlier AWS hypervisor maintenance.

AWS Control Tower landing zone addresses the separate need to establish governed multi-account environments with standardized controls because control Tower orchestrates a landing zone with account governance and guardrails; it is not as direct as Security posture evaluation for the actual requirement to identify departures from approved secure configuration baselines.

Centralized security logging addresses the separate need to retain and correlate audit records from multiple accounts because central collection helps security staff investigate activity without relying on individual workloads; it is not as direct as Security posture evaluation for the actual requirement to identify departures from approved secure configuration baselines.

Amazon VPC Flow Logs traffic metadata addresses the separate need to record selected IP network-flow information for VPC resources because VPC Flow Logs capture metadata about accepted or rejected traffic at supported interfaces; it is not as direct as Security posture evaluation for the actual requirement to identify departures from approved secure configuration baselines.