Collect recovery requirements and objectives is correct. After an organization sets the boundaries of its business continuity and disaster recovery plan the natural next step is to determine what must be recovered and how quickly so that strategies and priorities can be defined.

The reason Collect recovery requirements and objectives is correct is that boundaries tell you what is in scope and out of scope and the requirements and objectives translate that scope into measurable targets. These targets include recovery time objectives and recovery point objectives and critical system and process dependencies. Defining requirements and objectives guides later choices about recovery strategies resource allocation and testing.

Conduct a risk assessment is not the best answer here because risk assessments are typically performed earlier or in parallel to boundary definition to identify threats and impacts. By the time boundaries are set you need to use that context to capture recovery needs rather than start basic risk identification.

Execute a plan exercise is incorrect because exercises and testing occur after requirements are collected and the recovery plan is developed and implemented. You cannot effectively exercise a plan until you know the objectives and have built the procedures to meet them.

Issue reports and update documentation is wrong as the immediate next step because reporting and documentation updates follow analysis development and testing. Those activities come after requirements gathering and plan creation so reporting is a later maintenance task.

Full AWS Practitioner Certification Question