Statutorily controlled PII is the correct option.

Statutorily controlled PII refers to personally identifiable information that is protected by specific laws and regulations and that often carries defined penalties for unauthorized disclosure. When a statute explicitly protects a data element such as a Social Security number or similar identifier the government can pursue criminal charges for willful breaches under those laws. That legal basis and the explicit penalties are what make criminal prosecution most likely for this class of PII.

Unclassified PII is incorrect because unclassified data is not necessarily protected by specific criminal statutes. It may be low sensitivity information or only subject to agency policy and administrative controls and those situations rarely trigger criminal prosecution on their own.

Contract-based PII is incorrect because contractual obligations create civil and contractual remedies when violated. Breaching a contract can lead to damages or termination of agreements and possible administrative action but it does not by itself create criminal liability unless a separate statute is also violated.

Nonpublic PII is incorrect because nonpublic simply means the information is not openly available. It can be sensitive and require protection but that status does not guarantee statutory criminal penalties. Nonpublic information is more likely to lead to civil enforcement or administrative sanctions unless a law specifically criminalizes its disclosure.

Full AWS Practitioner Certification Question