Denial of service is correct because it appears on the Cloud Safety Consortium's list of twelve critical cloud threats and it is not included in the OWASP Top 10.

Denial of service attacks focus on availability and are especially relevant in cloud environments where shared infrastructure and scaling mechanisms can be abused to disrupt services. The cloud threat list calls out availability risks like this because they represent a distinct class of operational and infrastructure level threats that the OWASP Top 10 does not emphasize.

Injection is incorrect because it is a classic application layer flaw and it is explicitly included in the OWASP Top 10.

Sensitive data exposure is incorrect because it maps to data protection risks that OWASP covers under the Top 10 and it deals with confidentiality rather than the availability emphasis of a denial of service threat.

Broken access control is incorrect because it is listed in the OWASP Top 10 and it concerns authorization and privilege enforcement rather than service availability.

Full AWS Practitioner Certification Question