AWS Storage Gateway addresses the separate need to connect on-premises applications to cloud-backed storage interfaces because storage Gateway supports hybrid file volume and tape integration scenarios; it is not as direct as Amazon S3 One Zone-IA for the actual requirement to store recreatable infrequently accessed objects within one Availability Zone.

Amazon S3 Object Lock addresses the separate need to enforce supported WORM retention against object deletion or modification because object Lock supports retention modes and legal holds on eligible S3 object versions; it is not as direct as Amazon S3 One Zone-IA for the actual requirement to store recreatable infrequently accessed objects within one Availability Zone.

S3 server-side encryption addresses the separate need to encrypt S3 object data at rest using supported key arrangements because S3 encrypts stored object data at rest and supports key-management choices; it is not as direct as Amazon S3 One Zone-IA for the actual requirement to store recreatable infrequently accessed objects within one Availability Zone.

Internet gateway is intended to enable internet routing for resources in a VPC with suitable configuration because an internet gateway connects a VPC to the internet for eligible public addressing paths; in this design the new outcome is to enforce stateful inbound and outbound rules on supported resources, which calls for Security group rather than Internet gateway or the earlier Amazon VPC.

Amazon VPC primarily supports the earlier need to create a logically isolated IP network for AWS resources because a VPC defines virtual networking boundaries and hosts configurable subnets and routing, but the new task is to enforce stateful inbound and outbound rules on supported resources; that is why Security group is preferable here.

Public subnet is intended to place resources in a subnet with a route toward an internet gateway because a public subnet has a route to an attached internet gateway where applicable; in this design the new outcome is to enforce stateful inbound and outbound rules on supported resources, which calls for Security group rather than Public subnet or the earlier Amazon VPC.

Text sentiment classification primarily supports the earlier need to identify positive negative or neutral tone in a document because managed NLP sentiment analysis assesses the emotional polarity of text, but the new task is to extract printed and handwritten text and document structure; that is why Amazon Textract is preferable here.

Amazon Transcribe is intended to convert spoken audio into a text transcript because transcribe provides managed automatic speech recognition; in this design the new outcome is to extract printed and handwritten text and document structure, which calls for Amazon Textract rather than Amazon Transcribe or the earlier Text sentiment classification.

Amazon Translate is intended to translate text between supported human languages because translate is a machine-translation service used by multilingual applications; in this design the new outcome is to extract printed and handwritten text and document structure, which calls for Amazon Textract rather than Amazon Translate or the earlier Text sentiment classification.

The source application still needs an appropriate origin and cache policy; that caveat is associated more closely with Content delivery latency for the need to reduce time to download reusable web assets in different countries than with Amazon CloudFront for the requirement to cache web content at distributed edge locations near viewers.

An origin can still be a single point of failure unless designed for resilience; that caveat is associated more closely with CloudFront origin for the need to provide the source from which edge caches fetch content on a miss than with Amazon CloudFront for the requirement to cache web content at distributed edge locations near viewers.

An edge site is not a full substitute for application compute in an AWS Region; that caveat is associated more closely with Edge location for the need to deliver cached content closer to geographically dispersed end users than with Amazon CloudFront for the requirement to cache web content at distributed edge locations near viewers.

Gateway Load Balancer is intended to insert compatible virtual network appliances into traffic paths because gateway Load Balancer distributes flows across appliance targets for inspection or similar tasks; in this design the new outcome is to launch simple virtual servers with bundled management and predictable plans, which calls for Amazon Lightsail rather than Gateway Load Balancer or the earlier Amazon EC2.

EC2 user data is intended to perform initial bootstrap actions during instance launch because user data can provide launch-time configuration and installation scripts; in this design the new outcome is to launch simple virtual servers with bundled management and predictable plans, which calls for Amazon Lightsail rather than EC2 user data or the earlier Amazon EC2.

Amazon EC2 primarily supports the earlier need to operate virtual servers with explicit OS and instance management because EC2 provides configurable compute instances where customers manage guest OS and application software, but the new task is to launch simple virtual servers with bundled management and predictable plans; that is why Amazon Lightsail is preferable here.

That description belongs to Amazon ElastiCache because elastiCache offers managed in-memory caching engines to reduce repetitive backend reads; it is used to cache frequently accessed application data in memory, not to explain how DynamoDB point-in-time recovery provides the function to restore supported table data to a recent earlier point.

That description belongs to AWS Database Migration Service because AWS DMS can perform initial loading and change data capture for supported databases; it is used to move ongoing database data between supported source and destination engines, not to explain how DynamoDB point-in-time recovery provides the function to restore supported table data to a recent earlier point.

That description belongs to Amazon Redshift because redshift provides a cloud data warehouse optimized for analytical SQL workloads; it is used to analyze large structured data sets in a columnar warehouse, not to explain how DynamoDB point-in-time recovery provides the function to restore supported table data to a recent earlier point.

Amazon EventBridge is intended to route events from producers to targets using event patterns because eventBridge provides event buses and rule-based matching for supported events; in this design the new outcome is to distinguish event streams from independently consumed queued tasks, which calls for Amazon Kinesis versus SQS rather than Amazon EventBridge or the earlier Amazon CloudWatch.

Amazon CloudWatch primarily supports the earlier need to observe metrics logs alarms and events for running resources because cloudWatch helps monitor AWS workloads and alert on selected conditions, but the new task is to distinguish event streams from independently consumed queued tasks; that is why Amazon Kinesis versus SQS is preferable here.

Amazon SQS is intended to decouple systems with durable asynchronous message queues because sQS holds messages for consumers to process independently; in this design the new outcome is to distinguish event streams from independently consumed queued tasks, which calls for Amazon Kinesis versus SQS rather than Amazon SQS or the earlier Amazon CloudWatch.

Amazon OpenSearch Service primarily supports the earlier need to search and analyze indexed logs and document collections because openSearch Service supports search analytics and log exploration, but the new task is to analyze image or video content for objects and visual attributes; that is why Amazon Rekognition is preferable here.

Amazon Comprehend is intended to extract sentiment entities and other insights from text because comprehend provides managed natural-language processing APIs; in this design the new outcome is to analyze image or video content for objects and visual attributes, which calls for Amazon Rekognition rather than Amazon Comprehend or the earlier Amazon OpenSearch Service.

Amazon SageMaker AI is intended to build train and deploy custom machine learning models because sageMaker AI offers managed tooling for ML data preparation training and inference workflows; in this design the new outcome is to analyze image or video content for objects and visual attributes, which calls for Amazon Rekognition rather than Amazon SageMaker AI or the earlier Amazon OpenSearch Service.

EBS snapshot is intended to back up an EBS volume to durable AWS-managed snapshot storage because EBS snapshots capture volume data and can support recovery or creating new volumes; in this design the new outcome is to recognize block devices compared with managed network file systems, which calls for EBS versus EFS storage model rather than EBS snapshot or the earlier EBS volume encryption.

EBS volume encryption primarily supports the earlier need to protect block storage with supported at-rest encryption because encrypted EBS volumes use integrated key management for data at rest, but the new task is to recognize block devices compared with managed network file systems; that is why EBS versus EFS storage model is preferable here.

Amazon EBS is intended to attach persistent block-level storage to supported EC2 instances because EBS volumes provide durable block storage within an Availability Zone with supported snapshot options; in this design the new outcome is to recognize block devices compared with managed network file systems, which calls for EBS versus EFS storage model rather than Amazon EBS or the earlier EBS volume encryption.

That description belongs to VPC Flow Logs because VPC Flow Logs record accepted or rejected network-flow metadata in supported destinations; it is used to capture metadata about traffic to and from network interfaces, not to explain how Amazon VPC provides the function to create a logically isolated IP network for AWS resources.

That description belongs to Public subnet because a public subnet has a route to an attached internet gateway where applicable; it is used to place resources in a subnet with a route toward an internet gateway, not to explain how Amazon VPC provides the function to create a logically isolated IP network for AWS resources.

That description belongs to AWS Direct Connect because direct Connect provides a dedicated network connection through supported locations; it is used to establish dedicated private network connectivity from a site to AWS, not to explain how Amazon VPC provides the function to create a logically isolated IP network for AWS resources.

Global IAM identity scope primarily supports the earlier need to manage IAM identities used to authorize actions across AWS Regions because IAM is a global AWS service within an account, while service resources may be regional, but the new task is to route user traffic toward healthy regional endpoints through AWS global network paths; that is why AWS Global Accelerator is preferable here.

Availability Zone is intended to separate redundant application components across isolated facilities within one Region because an Availability Zone is one or more discrete data centers with independent infrastructure in a Region; in this design the new outcome is to route user traffic toward healthy regional endpoints through AWS global network paths, which calls for AWS Global Accelerator rather than Availability Zone or the earlier Global IAM identity scope.

AWS Region is intended to select a geographic area in which to place a workload because an AWS Region is a distinct geographic location containing multiple Availability Zones; in this design the new outcome is to route user traffic toward healthy regional endpoints through AWS global network paths, which calls for AWS Global Accelerator rather than AWS Region or the earlier Global IAM identity scope.