Select appropriate key management options based on requirements.

Select appropriate encryption options for data at rest and in transit for AWS services.

Determine the policies that need to be applied to objects based on access patterns.

Select appropriate AWS services to protect applications from external threats.

Select the appropriate routing mechanism to securely access AWS service endpoints or internet-based resources from Amazon VPC.

Determine a network segmentation strategy using public and private subnets.

Given traffic control requirements, determine when and how to use security groups and network ACLs.

Select appropriate services to create traceability for access to AWS resources.

Determine the secure method for an application to access AWS APIs.

Determine ways to secure credentials using features of AWS IAM.