AWS Config configuration history addresses a different objective, to review AWS resource configuration changes and compliance state, because config records supported resource configurations and evaluates them against configuration rules; the checklist instead requires the distinct outcomes to protect information while it travels over a network; identify departures from approved secure configuration baselines.

AWS WAF web request filtering addresses a different objective, to filter HTTP and HTTPS requests reaching supported applications, because wAF applies web access control rules against traffic patterns such as malicious requests; the checklist instead requires the distinct outcomes to protect information while it travels over a network; identify departures from approved secure configuration baselines.

Amazon Inspector vulnerability findings addresses a different objective, to identify software vulnerabilities and unintended network exposure on supported workloads, because inspector continuously assesses supported resources for vulnerabilities and exposure; the checklist instead requires the distinct outcomes to protect information while it travels over a network; identify departures from approved secure configuration baselines.

IAM role trust policy addresses the separate need to define which principals are allowed to assume a specific role because a role trust policy controls the trusted entities for role assumption; it is not as direct as AWS Secrets Manager for the actual requirement to store and rotate supported application secrets without hard-coding them.

Amazon Cognito user pools addresses the separate need to support sign-up and authentication of application end users because cognito user pools provide user directories and authentication features for apps; it is not as direct as AWS Secrets Manager for the actual requirement to store and rotate supported application secrets without hard-coding them.

AWS Systems Manager Parameter Store addresses the separate need to store configuration parameters and selected secrets for applications because parameter Store provides hierarchical parameter values with access controlled through IAM; it is not as direct as AWS Secrets Manager for the actual requirement to store and rotate supported application secrets without hard-coding them.

Amazon Cognito identity pools addresses the separate need to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; it is not as direct as Temporary session credentials for the actual requirement to avoid long-lived application secrets when making authorized AWS requests.

IAM policy condition addresses the separate need to limit authorized requests using context such as MFA, source or tags where supported because IAM policy conditions refine when an allow or deny statement applies; it is not as direct as Temporary session credentials for the actual requirement to avoid long-lived application secrets when making authorized AWS requests.

Customer managed IAM policies addresses the separate need to reuse an organization-authored permissions policy across appropriate identities because customer managed policies allow centralized versioning and reuse of customized permissions; it is not as direct as Temporary session credentials for the actual requirement to avoid long-lived application secrets when making authorized AWS requests.

Amazon CloudWatch metrics addresses the separate need to observe resource utilization and service performance over time because cloudWatch gathers metrics, alarms and logs for operational monitoring; it is not as direct as AWS Audit Manager evidence collection for the actual requirement to organize evidence of AWS usage for audit assessments.

AWS Security Hub centralized findings addresses the separate need to aggregate and prioritize security findings from AWS and partner services because security Hub centralizes security signals and posture findings across supported sources; it is not as direct as AWS Audit Manager evidence collection for the actual requirement to organize evidence of AWS usage for audit assessments.

Security incident response planning addresses the separate need to prepare containment, investigation and recovery processes before an incident because well-defined incident response combines people, procedures, monitoring and evidence retention; it is not as direct as AWS Audit Manager evidence collection for the actual requirement to organize evidence of AWS usage for audit assessments.

AWS Artifact compliance reports addresses the separate need to obtain AWS third-party compliance reports and contractual documents because artifact provides self-service access to selected AWS compliance documentation and agreements; it is not as direct as AWS Audit Manager evidence collection for the actual requirement to organize evidence of AWS usage for audit assessments.

AWS Security Lake centralized security data is intended to collect security logs in an analyzable data lake because security Lake can centralize supported security event and log data for analysis; in this design the new outcome is to locate sensitive information such as personal data in Amazon S3, which calls for Amazon Macie sensitive-data discovery rather than AWS Security Lake centralized security data or the earlier Encryption in transit.

Encryption in transit primarily supports the earlier need to protect information while it travels over a network because tLS and similar protocols help secure data exchanged between clients and services, but the new task is to locate sensitive information such as personal data in Amazon S3; that is why Amazon Macie sensitive-data discovery is preferable here.

Encryption at rest is intended to protect information stored on disks or in object services because storage encryption helps keep persisted data protected against unauthorized disclosure; in this design the new outcome is to locate sensitive information such as personal data in Amazon S3, which calls for Amazon Macie sensitive-data discovery rather than Encryption at rest or the earlier Encryption in transit.

Amazon Cognito identity pools is intended to provide AWS credentials to application users using supported identities because cognito identity pools exchange supported authentication for temporary AWS credentials; in this design the new outcome is to integrate existing workforce identities with AWS account access, which calls for IAM Identity Center external directory rather than Amazon Cognito identity pools or the earlier Federated identity access.

IAM role temporary credentials is intended to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; in this design the new outcome is to integrate existing workforce identities with AWS account access, which calls for IAM Identity Center external directory rather than IAM role temporary credentials or the earlier Federated identity access.

Federated identity access primarily supports the earlier need to let an existing external identity provider authenticate users for AWS access because federation allows trusted identities to receive AWS access without separate IAM user passwords, but the new task is to integrate existing workforce identities with AWS account access; that is why IAM Identity Center external directory is preferable here.

Amazon GuardDuty threat detection is intended to detect suspicious account or workload behavior from security signals because guardDuty analyzes supported event and telemetry sources to identify potential malicious activity; in this design the new outcome is to establish maximum account permissions across an AWS organization, which calls for AWS Organizations SCP rather than Amazon GuardDuty threat detection or the earlier AWS CloudTrail event history.

AWS CloudTrail event history primarily supports the earlier need to review who invoked AWS management API actions in an account because cloudTrail records AWS account API activity and supports investigation of management actions, but the new task is to establish maximum account permissions across an AWS organization; that is why AWS Organizations SCP is preferable here.

Access analysis is intended to find unintended external or broad permissions on AWS resources because IAM Access Analyzer can help identify supported resources shared with external principals and analyze access; in this design the new outcome is to establish maximum account permissions across an AWS organization, which calls for AWS Organizations SCP rather than Access analysis or the earlier AWS CloudTrail event history.

Root user credential protection is intended to reduce exposure of the AWS account's highly privileged root identity because AWS recommends protecting root credentials, enabling MFA and avoiding routine root use; in this design the new outcome is to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate, which calls for IAM user rather than Root user credential protection or the earlier IAM credential report.

IAM credential report primarily supports the earlier need to audit account IAM user credentials and their usage properties because IAM credential reports summarize credential status for IAM users in an account, but the new task is to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate; that is why IAM user is preferable here.

Inline IAM policy is intended to bind a permissions policy directly to one identity rather than sharing it because an inline policy maintains a one-to-one association with an IAM user, group or role; in this design the new outcome is to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate, which calls for IAM user rather than Inline IAM policy or the earlier IAM credential report.

IAM identity-based policy is intended to define what actions an IAM principal may perform on specified resources because identity-based policies attach to users, groups or roles and express allowed or denied actions; in this design the new outcome is to define which principals are allowed to assume a specific role, which calls for IAM role trust policy rather than IAM identity-based policy or the earlier IAM role permissions policy.

IAM role permissions policy primarily supports the earlier need to define which AWS operations a successfully assumed role can perform because permissions policies attached to a role determine allowed service actions within other policy limits, but the new task is to define which principals are allowed to assume a specific role; that is why IAM role trust policy is preferable here.

Permission sets for account assignments is intended to standardize workforce role assignments across multiple AWS accounts because IAM Identity Center permission sets help define permissions provisioned for assigned users or groups; in this design the new outcome is to define which principals are allowed to assume a specific role, which calls for IAM role trust policy rather than Permission sets for account assignments or the earlier IAM role permissions policy.

That description belongs to Encryption at rest because storage encryption helps keep persisted data protected against unauthorized disclosure; it is used to protect information stored on disks or in object services, not to explain how Encryption in transit provides the function to protect information while it travels over a network.

That description belongs to Amazon Macie sensitive-data discovery because macie uses machine learning and pattern matching to discover sensitive data in S3; it is used to locate sensitive information such as personal data in Amazon S3, not to explain how Encryption in transit provides the function to protect information while it travels over a network.

That description belongs to Amazon VPC Flow Logs traffic metadata because VPC Flow Logs capture metadata about accepted or rejected traffic at supported interfaces; it is used to record selected IP network-flow information for VPC resources, not to explain how Encryption in transit provides the function to protect information while it travels over a network.

AWS service compliance inheritance is intended to use AWS audited infrastructure controls as supporting evidence because customers may inherit relevant provider controls while remaining responsible for their own controls; in this design the new outcome is to establish governed multi-account environments with standardized controls, which calls for AWS Control Tower landing zone rather than AWS service compliance inheritance or the earlier AWS Organizations SCP.

AWS CloudTrail event history is intended to review who invoked AWS management API actions in an account because cloudTrail records AWS account API activity and supports investigation of management actions; in this design the new outcome is to establish governed multi-account environments with standardized controls, which calls for AWS Control Tower landing zone rather than AWS CloudTrail event history or the earlier AWS Organizations SCP.

AWS Organizations SCP primarily supports the earlier need to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts, but the new task is to establish governed multi-account environments with standardized controls; that is why AWS Control Tower landing zone is preferable here.