The correct option is Launch a campaign to draw attention to security risks.

Launch a campaign to draw attention to security risks is the right first action because it creates broad awareness and motivates the entire workforce to care about security. A campaign establishes leadership support and communicates simple, organizationwide behaviors that set the stage for later, more focused training and skill development. Starting with a campaign makes subsequent efforts to build proficiency and comprehension more effective because people are already engaged and receptive.

Develop workforce proficiency in specific security tasks is not the best first action because task level training assumes people already understand why the tasks matter and are motivated to change their behavior. Starting with detailed skills can leave many staff unengaged and reduce overall program reach.

Concentrate only on advanced security procedures is wrong because advanced procedures are appropriate for specialists and not for an organizationwide launch. Focusing only on advanced topics will alienate most employees and will not build the broad baseline awareness that is needed first.

Enhance comprehension of security concepts and their practical use is not the immediate first action because comprehension and practice are typically the next steps after awareness is established. Deepening understanding is important but it follows an initial campaign that creates interest and basic behavior change.

Full AWS Practitioner Certification Question