A shared access key makes individual investigation and revocation harder; that caveat is associated more closely with Avoid shared credentials for the need to retain individual accountability for actions taken in AWS than with IAM identity-based policy for the requirement to define what actions an IAM principal may perform on specified resources.

Trusting a principal to assume the role is not the same as authorizing every AWS action; that caveat is associated more closely with IAM role permissions policy for the need to define which AWS operations a successfully assumed role can perform than with IAM identity-based policy for the requirement to define what actions an IAM principal may perform on specified resources.

Roles avoid embedding a person's permanent access key in application code; that caveat is associated more closely with IAM role temporary credentials for the need to provide temporary access to a trusted principal or AWS workload than with IAM identity-based policy for the requirement to define what actions an IAM principal may perform on specified resources.

AWS regional facility redundancy primarily supports the earlier need to identify who maintains the independent infrastructure underlying Availability Zones because AWS builds and operates the physical infrastructure supporting Regions and AZs, but the new task is to identify who handles the underlying operating system for an Amazon RDS DB instance; that is why AWS managed RDS infrastructure is preferable here.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to identify who handles the underlying operating system for an Amazon RDS DB instance, which calls for AWS managed RDS infrastructure rather than Customer application patching on EC2 or the earlier AWS regional facility redundancy.

AWS global network infrastructure is intended to determine who operates the provider-owned physical networking fabric because AWS manages its worldwide network infrastructure and physical connectivity within its facilities; in this design the new outcome is to identify who handles the underlying operating system for an Amazon RDS DB instance, which calls for AWS managed RDS infrastructure rather than AWS global network infrastructure or the earlier AWS regional facility redundancy.

Separation of duties addresses the separate need to prevent one principal from controlling incompatible business functions because splitting sensitive privileges among roles reduces misuse and accidental changes; it is not as direct as Amazon Macie sensitive-data discovery for the actual requirement to locate sensitive information such as personal data in Amazon S3.

Access analysis addresses the separate need to find unintended external or broad permissions on AWS resources because IAM Access Analyzer can help identify supported resources shared with external principals and analyze access; it is not as direct as Amazon Macie sensitive-data discovery for the actual requirement to locate sensitive information such as personal data in Amazon S3.

Amazon GuardDuty threat detection addresses the separate need to detect suspicious account or workload behavior from security signals because guardDuty analyzes supported event and telemetry sources to identify potential malicious activity; it is not as direct as Amazon Macie sensitive-data discovery for the actual requirement to locate sensitive information such as personal data in Amazon S3.

IAM group primarily supports the earlier need to manage similar IAM user permissions through group membership because an IAM group is a collection of IAM users that can share attached permissions policies, but the new task is to audit account IAM user credentials and their usage properties; that is why IAM credential report is preferable here.

Amazon Cognito identity pools is intended to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; in this design the new outcome is to audit account IAM user credentials and their usage properties, which calls for IAM credential report rather than Amazon Cognito identity pools or the earlier IAM group.

IAM user is intended to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions; in this design the new outcome is to audit account IAM user credentials and their usage properties, which calls for IAM credential report rather than IAM user or the earlier IAM group.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to identify who replaces failed drives and server components in AWS facilities, which calls for AWS hardware lifecycle rather than Customer application patching on EC2 or the earlier AWS S3 infrastructure availability.

Customer RDS access controls is intended to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used; in this design the new outcome is to identify who replaces failed drives and server components in AWS facilities, which calls for AWS hardware lifecycle rather than Customer RDS access controls or the earlier AWS S3 infrastructure availability.

AWS S3 infrastructure availability primarily supports the earlier need to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3, but the new task is to identify who replaces failed drives and server components in AWS facilities; that is why AWS hardware lifecycle is preferable here.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to decide who chooses encryption settings and key access rules for customer information, which calls for Customer encryption configuration rather than Customer EC2 guest OS patching or the earlier Customer S3 bucket policy.

Customer data classification is intended to decide who labels business data by sensitivity before selecting controls because customers classify information and determine required access and protection levels; in this design the new outcome is to decide who chooses encryption settings and key access rules for customer information, which calls for Customer encryption configuration rather than Customer data classification or the earlier Customer S3 bucket policy.

Customer S3 bucket policy primarily supports the earlier need to decide who restricts public or cross-account access to stored objects because customers own S3 authorization configuration such as bucket policies and access settings, but the new task is to decide who chooses encryption settings and key access rules for customer information; that is why Customer encryption configuration is preferable here.

That description belongs to AWS KMS managed keys because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; it is used to control encryption keys for supported AWS integrated services, not to explain how Amazon Inspector vulnerability findings provides the function to identify software vulnerabilities and unintended network exposure on supported workloads.

That description belongs to AWS Certificate Manager TLS certificates because aCM manages public or imported certificates for use with integrated services; it is used to provision and manage certificates for supported TLS endpoints, not to explain how Amazon Inspector vulnerability findings provides the function to identify software vulnerabilities and unintended network exposure on supported workloads.

That description belongs to Encryption in transit because tLS and similar protocols help secure data exchanged between clients and services; it is used to protect information while it travels over a network, not to explain how Amazon Inspector vulnerability findings provides the function to identify software vulnerabilities and unintended network exposure on supported workloads.

IAM resource-based policy is intended to grant access through a policy attached to a supported resource because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; in this design the new outcome is to store and rotate supported application secrets without hard-coding them, which calls for AWS Secrets Manager rather than IAM resource-based policy or the earlier Temporary session credentials.

Amazon Cognito user pools is intended to support sign-up and authentication of application end users because cognito user pools provide user directories and authentication features for apps; in this design the new outcome is to store and rotate supported application secrets without hard-coding them, which calls for AWS Secrets Manager rather than Amazon Cognito user pools or the earlier Temporary session credentials.

Temporary session credentials primarily supports the earlier need to avoid long-lived application secrets when making authorized AWS requests because temporary credentials expire and can be issued through IAM roles and federation, but the new task is to store and rotate supported application secrets without hard-coding them; that is why AWS Secrets Manager is preferable here.

AWS CloudHSM dedicated HSMs addresses a different objective, to use customer-controlled single-tenant hardware security modules for key workloads, because cloudHSM offers dedicated HSM capacity for supported cryptographic applications; the checklist instead requires the distinct outcomes to protect information stored on disks or in object services; identify software vulnerabilities and unintended network exposure on supported workloads; collect security logs in an analyzable data lake.

AWS Config rules addresses a different objective, to evaluate a configuration against a defined compliance requirement, because config rules assess resource settings such as encryption or approved configuration states; the checklist instead requires the distinct outcomes to protect information stored on disks or in object services; identify software vulnerabilities and unintended network exposure on supported workloads; collect security logs in an analyzable data lake.

AWS service compliance inheritance addresses a different objective, to use AWS audited infrastructure controls as supporting evidence, because customers may inherit relevant provider controls while remaining responsible for their own controls; the checklist instead requires the distinct outcomes to protect information stored on disks or in object services; identify software vulnerabilities and unintended network exposure on supported workloads; collect security logs in an analyzable data lake.

Amazon Cognito identity pools addresses the separate need to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; it is not as direct as IAM access keys for the actual requirement to authorize programmatic AWS API access for a permitted IAM principal.

IAM identity-based policy addresses the separate need to define what actions an IAM principal may perform on specified resources because identity-based policies attach to users, groups or roles and express allowed or denied actions; it is not as direct as IAM access keys for the actual requirement to authorize programmatic AWS API access for a permitted IAM principal.

IAM resource-based policy addresses the separate need to grant access through a policy attached to a supported resource because resource-based policies, such as S3 bucket policies, can specify which principals may act on the resource; it is not as direct as IAM access keys for the actual requirement to authorize programmatic AWS API access for a permitted IAM principal.

AWS Config configuration history addresses a different objective, to review AWS resource configuration changes and compliance state, because config records supported resource configurations and evaluates them against configuration rules; the checklist instead requires the distinct outcomes to protect information while it travels over a network; identify departures from approved secure configuration baselines.

AWS WAF web request filtering addresses a different objective, to filter HTTP and HTTPS requests reaching supported applications, because wAF applies web access control rules against traffic patterns such as malicious requests; the checklist instead requires the distinct outcomes to protect information while it travels over a network; identify departures from approved secure configuration baselines.

Amazon Inspector vulnerability findings addresses a different objective, to identify software vulnerabilities and unintended network exposure on supported workloads, because inspector continuously assesses supported resources for vulnerabilities and exposure; the checklist instead requires the distinct outcomes to protect information while it travels over a network; identify departures from approved secure configuration baselines.