The correct choice is Operating and securing edge locations. Under the Shared Responsibility Model AWS is responsible for the security of the cloud which includes the physical facilities hardware and the global infrastructure such as Regions Availability Zones and edge locations.

AWS manages and secures the underlying infrastructure and the network that supports services and edge locations so customers do not control those physical and network components. This means AWS operates and hardens edge sites to provide availability and integrity of the delivery network while customers configure and protect the resources they run on AWS.

Configuring IAM users, roles, and policies is the customer's responsibility because identity and access management within an AWS account is part of security in the cloud and customers must set permissions monitor access and apply least privilege.

Protecting and classifying customer data is owned by the customer who must decide how to classify data apply encryption controls and manage backups and retention to meet compliance requirements.

Choosing and managing server-side encryption settings is also a customer task when they select encryption options manage keys and configure service settings although customers can choose AWS managed keys for some services which changes who manages the key material.

Full AWS Practitioner Certification Question