The correct answer is Threat modeling and analysis.

Threat modeling and analysis explicitly uses structured threat categorization and risk scoring to identify and prioritize threats. STRIDE provides a way to enumerate attack types against a design and DREAD supplies a method to assess and compare the risk and impact of those threats which makes both frameworks appropriate for threat modeling work.

Threat modeling and analysis is a proactive design and analysis activity that combines architecture review with attacker perspectives and risk prioritization. Using both STRIDE and DREAD helps teams decide which mitigations to implement first based on the most significant threats.

Cloud Security Command Center is a cloud provider security product that aggregates alerts and findings and provides visibility. It is a tool and not the analytical activity that applies STRIDE and DREAD to catalog attack patterns and score risks.

Automated vulnerability scanning discovers known flaws by scanning systems and comparing signatures or heuristics. It does not typically involve the systematic threat categorization and risk scoring that STRIDE and DREAD support which are manual or semi manual analysis techniques.

Penetration testing exercises simulate attacker behavior to find exploitable issues and validate controls. While penetration tests can be informed by threat models they are execution based assessments rather than the modeling and risk scoring activity described by the use of STRIDE and DREAD.

Full AWS Practitioner Certification Question