The correct option is They must align with organizational goals and be tracked by concrete business metrics.

This option is correct because governance risk and compliance objectives that map to organizational goals make it possible to show clear business value and to prioritize resources. Tracking objectives with concrete business metrics turns abstract risks into measurable outcomes that executives and stakeholders can understand and act on. Measurable metrics also allow teams to monitor progress over time and to tie improvements to business results.

They should rely exclusively on industry standards for benchmarking is incorrect because standards are useful as baselines but they do not capture an organization specific context. Relying exclusively on external benchmarks can miss unique business priorities and risk appetite and it can lead to objectives that do not drive internal value.

They are only necessary for organizations with more than 500 employees is incorrect because governance and compliance objectives are important for organizations of all sizes. Smaller organizations should scale objectives and metrics to fit their resources while still aligning with business goals and demonstrating value.

They only need to satisfy regulatory checklists is incorrect because checklists address minimum compliance but they do not ensure that controls deliver business risk reduction or strategic value. Objectives that focus solely on regulatory items can leave gaps in addressing operational risks and in demonstrating return on security and compliance investments.

Full AWS Practitioner Certification Question