Standardize and simplify security policies and procedures is correct.

Standardizing and simplifying policies and procedures reduces variability and inconsistency across the environment. When rules are clear and uniform teams can implement controls more consistently and automation becomes practical which lowers the chance of misconfiguration and gaps that attackers can exploit.

Simpler and standardized processes also make auditing and training easier because there are fewer special cases to review and fewer exceptions to manage. This clarity supports faster incident response and clearer ownership which improves overall security posture.

Increase the number of security controls is incorrect because adding controls without consolidation usually increases complexity and operational overhead. More controls can create more configuration points and dependencies that are hard to manage and that can actually weaken security.

Continuously revise and update security configurations is incorrect in this context because frequent changes alone do not reduce complexity. Continuous updates are valuable for patching and hardening but without standardization they can introduce drift and inconsistency that undermine security.

Centralize identity management and enforce least privilege with IAM is incorrect as the single best answer because IAM centralization is an important control but it addresses identity scope specifically. It does not by itself simplify all policies and procedures across different technologies and processes and it can introduce complexity if it is not part of a broader standardization effort.

Full AWS Practitioner Certification Question