Data protection and security controls is the correct option to examine most closely when confirming compliance with applicable laws and regulatory obligations for MeridianRisk.

Examining Data protection and security controls focuses on how the cloud provider handles personal and sensitive information and whether their technical and organisational measures meet legal requirements. This includes data residency and cross border transfer rules, encryption and key management, access controls and identity management, logging and auditability, breach notification timelines, and the provider's ability to support regulatory audits. It also covers contractual commitments such as data processing agreements and subcontractor obligations that demonstrate the provider will meet statutory duties.

Billing and invoicing arrangements are important for financial governance and cost management but they do not by themselves confirm compliance with privacy laws or industry regulations. Reviewing costs will not show whether data is protected or whether legal obligations are met.

Service level objectives and uptime guarantees define availability and performance expectations and they are essential for operational continuity. They do not address legal requirements such as data handling, breach reporting, or regulatory controls that determine compliance.

Contract termination and data export procedures are relevant because they touch on data return and deletion and on how data moves at the end of the relationship. They are still secondary to the broader Data protection and security controls which define ongoing compliance obligations and controls during the contract term.

Full AWS Practitioner Certification Question