Apply least privilege access is correct because it ensures users receive only the permissions they need to perform their job and no more which directly limits access to confidential records to authorized personnel.

This principle is implemented by granting the minimum necessary rights through role based access control and by using time limited or just in time permissions together with regular access reviews. These practices reduce the attack surface and help prevent unauthorized access to sensitive data.

Segregation of duties combined with least privilege access is incorrect because it mixes two concepts and the option as written is broader than the single control the question asks for. The question focuses on restricting who can access data and the precise control for that goal is granting only necessary permissions.

VPC Service Controls is incorrect because those controls provide network and service perimeter protections for cloud resources and they help prevent data exfiltration at the service boundary. They do not by themselves restrict which individual users can access confidential records.

Segregation of duties is incorrect because it is intended to prevent conflicts of interest by splitting responsibilities among multiple people. It does not directly limit user access to data based on job necessity in the way that granting only necessary permissions does.

Full AWS Practitioner Certification Question