The correct choice is Enforce comprehensive data privacy policies and perform recurring audits of data access and use.

Enforce comprehensive data privacy policies and perform recurring audits of data access and use sets clear expectations for consent, data minimization, and least privilege and recurring audits verify those controls are followed and help detect misuse. Regular reviews also demonstrate compliance with regulations such as GDPR and FERPA and ensure that retaining activity logs for 90 days is justified and monitored.

Amazon SageMaker Model Monitor is useful for detecting model drift and data quality issues and it does not create or enforce privacy policies or consent requirements and it cannot by itself provide acceptable use governance.

AWS Key Management Service provides encryption and key control and that protects data at rest and in transit and it does not by itself ensure ethical use, informed consent, or oversight of who may access student records.

Use proprietary datasets without obtaining user consent is inappropriate and often illegal and it violates privacy expectations and responsible AI principles and therefore it is not a valid practice for handling sensitive student data.

Full AWS Practitioner Certification Question