The correct answer is Design and architecture phase.

During the Design and architecture phase formal requirements for risk mitigation are translated into concrete architecture decisions and detailed design specifications. This phase is where threat modeling is performed and specific security controls and data flow protections are chosen so that developers and testers have clear, implementable guidance.

Capturing mitigation requirements in the Design and architecture phase ensures security is built into the system rather than added later. The design documents define component responsibilities, trust boundaries, and assurance activities that guide secure implementation and verification.

Development phase is incorrect because that phase focuses on writing code and unit testing. Developers implement the design and apply secure coding practices, but the formal specification of mitigations belongs in the prior design work.

Maintenance and operations phase is incorrect because that phase addresses ongoing support, patching, and monitoring. It is intended for fixes and operational controls rather than for first integrating formal mitigation requirements into the program design.

Requirements analysis and feasibility phase is incorrect because that phase gathers stakeholder needs and assesses whether the project is viable. It sets high level security goals but does not convert those goals into the concrete design decisions and controls that are produced during the architecture phase.

Full AWS Practitioner Certification Question