The correct option is AWS IAM Identity Center which is the appropriate service to manage users and assign permission boundaries for Amazon Q Business.

AWS IAM Identity Center centralizes workforce identity and group management and it integrates with external identity providers and enterprise directories. It lets administrators create permission sets and assign them to groups so users receive consistent least privilege access across AWS accounts and services including Amazon Q Business.

Amazon DynamoDB is a managed NoSQL database and it does not provide authentication or authorization workflows for workforce access or permission sets.

AWS Organizations is used to manage multiple AWS accounts and to apply account level policies and it is not intended for user sign in flows or per user application permission assignment.

Amazon Cognito focuses on customer identity for web and mobile applications and it is not the best fit for centralized workforce single sign on and permission sets to AWS services.

Full AWS Practitioner Certification Question