Regularly review IAM policies and usage to enforce least privilege and Require multi-factor authentication for all identities, including the root user are correct because they are explicit customer responsibilities under the AWS Shared Responsibility Model when controlling access to resources.

Regularly review IAM policies and usage to enforce least privilege is correct because customers define, apply, and audit identity and access controls. Regular reviews of roles, policies, and usage help remove excessive permissions and reduce blast radius from compromised credentials.

Require multi-factor authentication for all identities, including the root user is correct because enabling and enforcing MFA is a configuration and operational choice that the customer must make to strengthen account security and protect high privilege identities.

Manage and secure the global AWS network infrastructure is incorrect because AWS is responsible for securing the global network and data centers that run the cloud services.

AWS Organizations is incorrect because it is an AWS service and not a responsibility. Using it is optional and it does not change the division of duties in the shared responsibility model.

Hardening and vulnerability scanning of AWS-managed hypervisors and facility systems is incorrect because AWS secures the underlying compute, storage, networking, and physical infrastructure that customers do not operate.

Full AWS Practitioner Certification Question