Amazon SNS addresses a different objective, to fan out notifications to multiple subscribed endpoints, because sNS uses topics and subscriptions to publish messages to multiple destinations; the checklist instead requires the distinct outcomes to offer provisionable approved products to internal teams; connect IoT devices securely to cloud applications and messaging.

AWS Systems Manager addresses a different objective, to perform operational automation and inventory for fleets, because systems Manager supplies run command automation patching and fleet management; the checklist instead requires the distinct outcomes to offer provisionable approved products to internal teams; connect IoT devices securely to cloud applications and messaging.

Amazon Kinesis versus SQS addresses a different objective, to distinguish event streams from independently consumed queued tasks, because kinesis is oriented toward ordered streaming data while SQS supports decoupled message processing; the checklist instead requires the distinct outcomes to offer provisionable approved products to internal teams; connect IoT devices securely to cloud applications and messaging.

AWS Cloud Development Kit (AWS CDK) is intended to define AWS infrastructure using familiar programming languages because AWS CDK constructs synthesize infrastructure definitions for deployment through CloudFormation; in this design the new outcome is to offer approved infrastructure products through governed self-service, which calls for AWS Service Catalog rather than AWS Cloud Development Kit (AWS CDK) or the earlier AWS CloudFormation.

AWS CloudFormation primarily supports the earlier need to recreate multi-resource infrastructure from versioned templates because cloudFormation models resources as stacks and applies managed creation and update operations, but the new task is to offer approved infrastructure products through governed self-service; that is why AWS Service Catalog is preferable here.

AWS service APIs is intended to interact programmatically with AWS using supported service requests because AWS APIs expose actions and resource operations through defined programmatic interfaces; in this design the new outcome is to offer approved infrastructure products through governed self-service, which calls for AWS Service Catalog rather than AWS service APIs or the earlier AWS CloudFormation.

Route table addresses the separate need to decide where traffic from a subnet should be directed because VPC route tables contain destination-prefix routing entries for network traffic; it is not as direct as Network ACL for the actual requirement to apply stateless allow and deny rules at the subnet boundary.

Internet gateway addresses the separate need to enable internet routing for resources in a VPC with suitable configuration because an internet gateway connects a VPC to the internet for eligible public addressing paths; it is not as direct as Network ACL for the actual requirement to apply stateless allow and deny rules at the subnet boundary.

Stateless versus stateful filtering addresses the separate need to select whether connection return traffic needs independent explicit rules because security groups track allowed connections while network ACLs evaluate both directions without state; it is not as direct as Network ACL for the actual requirement to apply stateless allow and deny rules at the subnet boundary.

Amazon Route 53 addresses the separate need to resolve application domain names and apply supported DNS routing policies because Route 53 is a managed DNS and domain service with traffic-routing and health-check features; it is not as direct as Network ACL for the actual requirement to apply stateless allow and deny rules at the subnet boundary.

That description belongs to AWS Lambda because lambda runs functions in managed execution environments with service-defined execution constraints; it is used to execute event-triggered code without managing virtual servers, not to explain how Amazon CloudWatch EC2 metrics provides the function to monitor resource behavior to inform scaling and alerts.

That description belongs to Vertical EC2 scaling because vertical scaling provides more CPU or RAM within a single virtual machine; it is used to increase resource capacity by changing the instance type, not to explain how Amazon CloudWatch EC2 metrics provides the function to monitor resource behavior to inform scaling and alerts.

That description belongs to Amazon EC2 because EC2 provides configurable compute instances where customers manage guest OS and application software; it is used to operate virtual servers with explicit OS and instance management, not to explain how Amazon CloudWatch EC2 metrics provides the function to monitor resource behavior to inform scaling and alerts.

Amazon Textract addresses the separate need to extract printed and handwritten text and document structure because textract reads forms tables and text from supported document inputs; it is not as direct as Amazon EMR for the actual requirement to run supported big-data frameworks such as Apache Spark.

Pretrained AI API versus custom ML addresses the separate need to choose an appropriate level of model customization because pretrained APIs accelerate common text speech and vision tasks; SageMaker AI supports custom model workflows; it is not as direct as Amazon EMR for the actual requirement to run supported big-data frameworks such as Apache Spark.

Amazon Polly addresses the separate need to convert written text into natural-sounding spoken audio because polly provides text-to-speech generation for applications; it is not as direct as Amazon EMR for the actual requirement to run supported big-data frameworks such as Apache Spark.

Availability Zone is intended to separate redundant application components across isolated facilities within one Region because an Availability Zone is one or more discrete data centers with independent infrastructure in a Region; in this design the new outcome is to manage IAM identities used to authorize actions across AWS Regions, which calls for Global IAM identity scope rather than Availability Zone or the earlier Regional service scope.

Regional service scope primarily supports the earlier need to recognize that many AWS resources exist only in a selected Region because regional services require selecting the location where supported resources are created, but the new task is to manage IAM identities used to authorize actions across AWS Regions; that is why Global IAM identity scope is preferable here.

AWS Region is intended to select a geographic area in which to place a workload because an AWS Region is a distinct geographic location containing multiple Availability Zones; in this design the new outcome is to manage IAM identities used to authorize actions across AWS Regions, which calls for Global IAM identity scope rather than AWS Region or the earlier Regional service scope.

AWS Database Migration Service primarily supports the earlier need to move ongoing database data between supported source and destination engines because AWS DMS can perform initial loading and change data capture for supported databases, but the new task is to move between dissimilar database engines with possible schema translation; that is why Heterogeneous database migration is preferable here.

RDS Multi-AZ configuration is intended to improve database availability using a standby in another Availability Zone because RDS Multi-AZ options support failover when the primary or supporting infrastructure fails; in this design the new outcome is to move between dissimilar database engines with possible schema translation, which calls for Heterogeneous database migration rather than RDS Multi-AZ configuration or the earlier AWS Database Migration Service.

Amazon RDS is intended to operate a managed relational database engine because RDS automates selected relational database operations including backup and patching; in this design the new outcome is to move between dissimilar database engines with possible schema translation, which calls for Heterogeneous database migration rather than Amazon RDS or the earlier AWS Database Migration Service.

Gateway Load Balancer addresses the separate need to insert compatible virtual network appliances into traffic paths because gateway Load Balancer distributes flows across appliance targets for inspection or similar tasks; it is not as direct as Application Load Balancer for the actual requirement to route HTTP and HTTPS requests using application-layer rules.

Network Load Balancer addresses the separate need to handle high-performance connection-level TCP or UDP traffic because nLB routes connections at the transport layer and supports static IP behavior; it is not as direct as Application Load Balancer for the actual requirement to route HTTP and HTTPS requests using application-layer rules.

EC2 user data addresses the separate need to perform initial bootstrap actions during instance launch because user data can provide launch-time configuration and installation scripts; it is not as direct as Application Load Balancer for the actual requirement to route HTTP and HTTPS requests using application-layer rules.

That description belongs to Regional service availability check because AWS service availability varies by Region and sometimes by instance family or feature; it is used to verify a particular offering is available in the chosen Region, not to explain how Cross-Region replication provides the function to maintain copies of selected data outside its source Region.

That description belongs to Data residency by Region because region placement and configured replication determine where supported AWS workload data resides; it is used to keep stored customer data in a selected geography, not to explain how Cross-Region replication provides the function to maintain copies of selected data outside its source Region.

That description belongs to Regional service scope because regional services require selecting the location where supported resources are created; it is used to recognize that many AWS resources exist only in a selected Region, not to explain how Cross-Region replication provides the function to maintain copies of selected data outside its source Region.

That description belongs to S3 server-side encryption because S3 encrypts stored object data at rest and supports key-management choices; it is used to encrypt S3 object data at rest using supported key arrangements, not to explain how Amazon S3 Object Lock provides the function to enforce supported WORM retention against object deletion or modification.

That description belongs to S3 Versioning because versioning maintains version identifiers for changed objects in a bucket; it is used to retain multiple object versions to aid recovery from deletion or overwrite, not to explain how Amazon S3 Object Lock provides the function to enforce supported WORM retention against object deletion or modification.

That description belongs to EBS volume encryption because encrypted EBS volumes use integrated key management for data at rest; it is used to protect block storage with supported at-rest encryption, not to explain how Amazon S3 Object Lock provides the function to enforce supported WORM retention against object deletion or modification.

Amazon SNS is intended to fan out notifications to multiple subscribed endpoints because sNS uses topics and subscriptions to publish messages to multiple destinations; in this design the new outcome is to decouple systems with durable asynchronous message queues, which calls for Amazon SQS rather than Amazon SNS or the earlier AWS X-Ray.

AWS X-Ray primarily supports the earlier need to trace distributed requests through supported application components because x-Ray provides distributed tracing to help find latency and failure sources, but the new task is to decouple systems with durable asynchronous message queues; that is why Amazon SQS is preferable here.

Amazon MQ is intended to migrate applications needing managed message brokers and standard protocols because Amazon MQ supports broker engines such as ActiveMQ or RabbitMQ; in this design the new outcome is to decouple systems with durable asynchronous message queues, which calls for Amazon SQS rather than Amazon MQ or the earlier AWS X-Ray.