The correct options are Produce audit and usage reports to support compliance and operational decisions, Investigate applications that receive high risk or suspicious scores, and Implement conditional access rules to control app access based on risk signals.

Producing audit and usage reports gives administrators the evidence they need to meet compliance obligations and to see which applications are widely used or carry potential exposure. Reports help prioritize remediation by showing scope and user adoption so that efforts focus on the highest impact issues.

Investigating applications that receive high risk or suspicious scores lets teams validate whether a finding is a true risk or a false positive. Investigation provides context about user behavior and app traffic which supports targeted responses rather than disruptive broad actions.

Implementing conditional access rules allows administrators to apply risk based controls so access can be restricted or challenged for risky sessions while preserving access for safe use. Conditional access is a way to enforce policies dynamically based on signals from discovery and risk scoring.

Immediately block every unsanctioned application without assessment is incorrect because blanket blocking can interrupt legitimate business processes and create operational problems. Administrators should assess risk and use reports and conditional controls to take measured, proportionate actions rather than immediate universal blocking.

Full AWS Practitioner Certification Question