AWS Control Tower landing zone addresses the separate need to establish governed multi-account environments with standardized controls because control Tower orchestrates a landing zone with account governance and guardrails; it is not as direct as Security posture evaluation for the actual requirement to identify departures from approved secure configuration baselines.

Centralized security logging addresses the separate need to retain and correlate audit records from multiple accounts because central collection helps security staff investigate activity without relying on individual workloads; it is not as direct as Security posture evaluation for the actual requirement to identify departures from approved secure configuration baselines.

Amazon VPC Flow Logs traffic metadata addresses the separate need to record selected IP network-flow information for VPC resources because VPC Flow Logs capture metadata about accepted or rejected traffic at supported interfaces; it is not as direct as Security posture evaluation for the actual requirement to identify departures from approved secure configuration baselines.

IAM resource-based policy addresses the separate need to grant access through a policy attached to a supported resource because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; it is not as direct as IAM user for the actual requirement to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate.

IAM credential report addresses the separate need to audit account IAM user credentials and their usage properties because IAM credential reports summarize credential status for IAM users in an account; it is not as direct as IAM user for the actual requirement to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate.

IAM policy condition addresses the separate need to limit authorized requests using context such as MFA, source or tags where supported because IAM policy conditions refine when an allow or deny statement applies; it is not as direct as IAM user for the actual requirement to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate.

Amazon Inspector addresses the separate need to assess supported workloads for exploitable software weaknesses because inspector identifies vulnerability and exposure findings for covered resources; it is not as direct as Amazon GuardDuty for the actual requirement to surface suspicious activity using threat intelligence and anomaly analysis.

AWS Trusted Advisor addresses the separate need to review common security and configuration opportunities alongside operational checks because trusted Advisor provides best-practice checks in several categories; it is not as direct as Amazon GuardDuty for the actual requirement to surface suspicious activity using threat intelligence and anomaly analysis.

Amazon Detective addresses the separate need to investigate relationships and context around suspicious activity because detective helps security analysts explore activity and connected evidence; it is not as direct as Amazon GuardDuty for the actual requirement to surface suspicious activity using threat intelligence and anomaly analysis.

AWS Certificate Manager TLS certificates is intended to provision and manage certificates for supported TLS endpoints because aCM manages public or imported certificates for use with integrated services; in this design the new outcome is to control encryption keys for supported AWS integrated services, which calls for AWS KMS managed keys rather than AWS Certificate Manager TLS certificates or the earlier AWS Shield DDoS protection.

AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to control encryption keys for supported AWS integrated services, which calls for AWS KMS managed keys rather than AWS Security Hub centralized findings or the earlier AWS Shield DDoS protection.

AWS Shield DDoS protection primarily supports the earlier need to reduce the effect of distributed denial-of-service attacks on supported applications because shield provides DDoS protection for supported AWS resources, with additional capabilities in advanced offerings, but the new task is to control encryption keys for supported AWS integrated services; that is why AWS KMS managed keys is preferable here.

AWS Knowledge Center is intended to find answers to common AWS technical and security questions because the Knowledge Center provides support-style articles about known issues and features; in this design the new outcome is to review centralized security posture and findings from multiple sources, which calls for AWS Security Hub rather than AWS Knowledge Center or the earlier AWS Security Blog.

AWS Security Center is intended to find AWS security resources and information in one place because AWS security portals collect information about AWS cloud security capabilities; in this design the new outcome is to review centralized security posture and findings from multiple sources, which calls for AWS Security Hub rather than AWS Security Center or the earlier AWS Security Blog.

AWS Security Blog primarily supports the earlier need to read AWS-authored security guidance, news and technical practices because the AWS Security Blog publishes security-focused articles and examples, but the new task is to review centralized security posture and findings from multiple sources; that is why AWS Security Hub is preferable here.

That description belongs to Customer IAM permission design because customers create access rules and identities suited to organizational least-privilege requirements; it is used to decide who grants access permissions to customer data and AWS resources, not to explain how Customer compliance obligations provides the function to determine who ensures application use and data handling meet the customer's regulations.

That description belongs to Customer application patching on EC2 because the customer is responsible for custom code and software installed on its virtual machines; it is used to determine who updates software installed by a customer on an EC2 VM, not to explain how Customer compliance obligations provides the function to determine who ensures application use and data handling meet the customer's regulations.

That description belongs to Customer EC2 guest OS patching because customers maintain the guest OS, including relevant patches, configuration and hardening; it is used to determine who installs security updates inside a customer-managed EC2 operating system, not to explain how Customer compliance obligations provides the function to determine who ensures application use and data handling meet the customer's regulations.

That description belongs to IAM group because an IAM group is a collection of IAM users that can share attached permissions policies; it is used to manage similar IAM user permissions through group membership, not to explain how Avoid shared credentials provides the function to retain individual accountability for actions taken in AWS.

That description belongs to IAM identity-based policy because identity-based policies attach to users, groups or roles and express allowed or denied actions; it is used to define what actions an IAM principal may perform on specified resources, not to explain how Avoid shared credentials provides the function to retain individual accountability for actions taken in AWS.

That description belongs to IAM user because IAM users are identities defined within an AWS account with configurable permissions; it is used to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate, not to explain how Avoid shared credentials provides the function to retain individual accountability for actions taken in AWS.

That description belongs to IAM access keys because an access key ID and secret key can sign API requests but require careful protection and rotation; it is used to authorize programmatic AWS API access for a permitted IAM principal, not to explain how Explicit deny precedence provides the function to ensure a denied API action cannot be overridden by another allow statement.

That description belongs to Implicit deny default because AWS authorization defaults to denying requests unless a valid policy grants the needed action; it is used to understand why a principal cannot act without an applicable permission, not to explain how Explicit deny precedence provides the function to ensure a denied API action cannot be overridden by another allow statement.

That description belongs to Cross-account role assumption because a cross-account role requires suitable trust and permission configuration; it is used to allow a principal in one AWS account to gain defined temporary permissions in another, not to explain how Explicit deny precedence provides the function to ensure a denied API action cannot be overridden by another allow statement.

Centralized security logging primarily supports the earlier need to retain and correlate audit records from multiple accounts because central collection helps security staff investigate activity without relying on individual workloads, but the new task is to review common security and configuration recommendations in AWS accounts; that is why AWS Trusted Advisor security checks is preferable here.

AWS Config rules is intended to evaluate a configuration against a defined compliance requirement because config rules assess resource settings such as encryption or approved configuration states; in this design the new outcome is to review common security and configuration recommendations in AWS accounts, which calls for AWS Trusted Advisor security checks rather than AWS Config rules or the earlier Centralized security logging.

AWS Security Hub centralized findings is intended to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; in this design the new outcome is to review common security and configuration recommendations in AWS accounts, which calls for AWS Trusted Advisor security checks rather than AWS Security Hub centralized findings or the earlier Centralized security logging.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to identify who maintains the infrastructure used to operate Amazon S3, which calls for AWS S3 infrastructure availability rather than Customer application patching on EC2 or the earlier AWS physical data-center security.

Customer EC2 security groups is intended to decide who configures firewall rules around a customer instance because customers choose inbound and outbound security-group permissions for their resources; in this design the new outcome is to identify who maintains the infrastructure used to operate Amazon S3, which calls for AWS S3 infrastructure availability rather than Customer EC2 security groups or the earlier AWS physical data-center security.

AWS physical data-center security primarily supports the earlier need to identify who protects buildings, hardware and physical facilities because AWS controls physical access, environmental safeguards and infrastructure facilities supporting its services, but the new task is to identify who maintains the infrastructure used to operate Amazon S3; that is why AWS S3 infrastructure availability is preferable here.

Its check coverage differs from dedicated attack-detection tools; that caveat is associated more closely with AWS Trusted Advisor for the need to review common security and configuration opportunities alongside operational checks than with AWS Firewall Manager for the requirement to apply common web and network protection policies across accounts.

It is reference material, not a log collection service; that caveat is associated more closely with AWS Knowledge Center for the need to find answers to common AWS technical and security questions than with AWS Firewall Manager for the requirement to apply common web and network protection policies across accounts.

Reviewing permissions differs from threat-intelligence detection of malicious behavior; that caveat is associated more closely with AWS IAM Access Analyzer for the need to detect external sharing and analyze access policies for supported resources than with AWS Firewall Manager for the requirement to apply common web and network protection policies across accounts.