The correct answer is Maintaining ongoing visibility into the information systems' security posture.

Maintaining ongoing visibility into the information systems' security posture is the primary goal of continuous monitoring because the point of continuous monitoring is to collect telemetry and security signals on an ongoing basis. Continuous monitoring provides near real time awareness of threats, vulnerabilities, configuration drift, and compliance gaps so that risk can be detected and managed promptly rather than waiting for periodic reviews.

Applying Identity and Access Management policy updates across projects is incorrect because that describes an operational implementation task. Continuous monitoring observes and reports on the environment and does not itself perform policy updates.

Conducting periodic system recertification and formal authorization reviews is incorrect because those activities are periodic and point in time. Continuous monitoring is continuous by definition and focuses on ongoing visibility rather than episodic recertification events.

Assessing whether implemented security controls are functioning as intended is incorrect as the best single choice because control assessment is a related activity and may be part of a monitoring program. The broader and primary objective of continuous monitoring is to maintain ongoing visibility into the overall security posture rather than focusing solely on individual control testing.

Full AWS Practitioner Certification Question