ISO/IEC 27001:2022 is the correct option.

ISO/IEC 27001:2022 is an international information security management system standard that specifies requirements for establishing implementing and maintaining a risk based ISMS. It provides a formal certification path and a governance framework that organizations worldwide adopt to protect the confidentiality integrity and availability of information.

NIST SP 800-53 is a comprehensive catalog of security and privacy controls that is widely used by US federal agencies and by other organizations. It is a controls catalog rather than an international management system and it does not provide a global certification pathway which is why it is not considered the gold standard for an organization wide ISMS.

SOC 2 is an attestation report based on the AICPA Trust Services Criteria and it focuses on controls at service organizations. It supports vendor assurance and contractual trust but it is not a management system standard with formal international certification and that is why it is not the gold standard answer.

FIPS 140-2 defines security requirements for cryptographic modules rather than for an organization wide information security management system. It has also been superseded by FIPS 140-3 which makes FIPS 140-2 a less likely expected answer on newer exams.

Full AWS Practitioner Certification Question