The recipient is outside the organization is the correct choice.

Add the condition The recipient is outside the organization to a mail flow rule to match messages delivered to external recipients. This condition evaluates who will receive the message so you can apply an action such as encryption only when the final recipient is not within your tenant.

The recipient is inside the organization is incorrect because it matches internal recipients and would cause encryption for messages that stay inside the company rather than for external deliveries.

The sender is outside the organization is incorrect because it triggers based on who sends the message and not who receives it. That rule could encrypt messages from external senders even when the recipients are internal.

The sender is inside the organization is incorrect because it would match messages sent by internal users and not specifically those delivered to external people. This would not meet the stated goal of encrypting only external deliveries.

Full AWS Practitioner Certification Question