Provide assessors with clear visibility into the system's security architecture is correct.

Network topology diagrams show component locations, connectivity, trust boundaries, and data flows so assessors can identify where controls must be applied and where risks are concentrated. These diagrams make the system architecture explicit and reduce ambiguity during security reviews.

Configuration management plans document baselines, approved changes, versioning, and patching processes so assessors can verify that configurations are controlled, reproducible, and maintained in a secure state. Together the diagrams and the configuration plan let assessors corroborate technical evidence with documented processes and change history.

Enable automated assessment tools such as Security Command Center is incorrect because diagrams and plans are primarily documentation for human and procedural review. They may support automated tools by clarifying scope, but they do not by themselves enable the tools or replace telemetry and API integrations that automated scanners require.

Serve as the only evidence required for privacy compliance is incorrect because privacy compliance requires multiple artifacts such as data inventories, consent records, privacy impact assessments, and policy documentation. Diagrams and configuration plans contribute useful technical context but they are not sufficient alone to demonstrate privacy controls.

Meet only statutory or regulatory obligations is incorrect because topology diagrams and configuration management plans also support secure design, operational decision making, incident response, and auditability. They have practical engineering and governance value beyond satisfying legal requirements.

Full AWS Practitioner Certification Question