The correct answer is Phishing awareness, password hygiene, data handling practices, mobile device protection and social engineering awareness.

These topics form the core of an organization wide security awareness program because they teach everyday employees how to recognize and respond to common threats. Training in phishing awareness helps staff spot malicious emails and links. Instruction on password hygiene encourages creation and management of strong credentials. Guidance on data handling practices shows how to protect sensitive information. Advice about mobile device protection reduces risk from lost or compromised devices. Education on social engineering awareness helps people understand manipulative tactics attackers use.

Client service practices, productivity software training, business analytics methods and financial reporting procedures is incorrect because it lists business skills and role specific training rather than security awareness topics. Those items improve job performance but they do not teach the security behaviors that reduce cyber risk.

Identity and access management, firewall configuration, encryption key rotation, logging and monitoring and backup policies is incorrect because these are technical controls and operational tasks. They belong in IT and security operations training rather than in broad awareness courses for all employees.

Facility access control, occupational safety procedures, first aid training and emergency evacuation processes is incorrect because those focus on physical safety and facility management. They may be part of physical security or safety training but they are not central to information security awareness about digital threats.

Full AWS Practitioner Certification Question