Measures that prevent unauthorized users from gaining access to resources is the correct description of access control within an information technology environment.

Access control describes the combination of policies, processes, and technical mechanisms that ensure only authorized users and systems can access resources. Access control includes verifying identity through authentication, granting appropriate privileges through authorization, and monitoring activity to detect and respond to unauthorized attempts.

Cloud Key Management Service is incorrect because it names a specific service used to manage cryptographic keys and protect secrets. Key management can support access control but it does not define the broader set of controls that prevent unauthorized access.

The capability to read and modify data within a system is incorrect because that phrase describes permissions or privileges that may be granted once access is allowed. It does not define the preventive controls and policies that restrict who can gain access in the first place.

Provisioning resources for users based on their assigned roles and responsibilities is incorrect because that describes role based provisioning or an access model rather than the overall concept of access control. Provisioning is one administrative activity and one implementation approach but it is not the full definition of preventing unauthorized access.

Full AWS Practitioner Certification Question