Control strength describes a control's designed robustness while effectiveness describes how well that control operates in real world use is the correct option.

Control strength refers to how a control is designed and constructed to resist threats and failures. It covers the intended robustness, the chosen controls, and the design decisions that determine how well the control should work under expected conditions.

Effectiveness describes how the control actually performs in operational use. It is demonstrated by monitoring, testing, incident outcomes, and measurement of operational metrics rather than by design documents alone.

Control strength is measured by deployment count and effectiveness is based on audit pass rates is incorrect because the number of deployments does not by itself indicate how robust a control is and audit pass rates are only one form of evidence of performance. Real effectiveness requires operational measurement and contextual evaluation beyond simple counts and pass rates.

Assurance denotes the confidence in controls and therefore overlaps with both strength and effectiveness is incorrect as stated because assurance is a related but distinct concept. Assurance is the degree of confidence supported by evidence and assessment activities. It informs whether strength and effectiveness are believed to be sufficient, but it is not the same as either design robustness or operational performance.

Both concepts refer solely to control configuration settings in systems is incorrect because control strength and effectiveness apply to people, processes, and technology. Many controls are procedural or managerial and their strength and effectiveness depend on training, policy, and execution as well as technical configuration.

Full AWS Practitioner Certification Question