The correct option is Unvalidated redirects and forwards.

This situation occurs when an application sends users to external destinations based on input that is not checked. An attacker can craft a link that looks legitimate but sends a user to a malicious site to phish credentials or host malware. The core problem is lack of validation of the destination URL which is exactly what unvalidated redirects and forwards describe.

Sensitive data exposure is incorrect because that category deals with failures to protect confidential information in storage or transit and not with redirecting users to malicious pages.

Broken access control is incorrect because that refers to users gaining actions or resources they are not authorized to access and not to being redirected to an attacker controlled site.

Security misconfiguration is incorrect because that covers incorrect server or framework settings that expose systems and not the specific issue of accepting attacker controlled redirect destinations without validation.

Full AWS Practitioner Certification Question