Confirming that controls continue to address current risks and meet applicable compliance requirements is the correct choice.

This option is correct because scheduled revisions should verify that controls remain aligned with the organisation's risk profile and with current legal and regulatory obligations. Regular confirmation helps ensure controls still achieve their objectives when threats, systems, or compliance requirements change.

Effective reviews rely on evidence such as test results, incident history, and audit findings to determine whether controls are performing as intended. That evidence driven approach shows whether controls need adjustment, stronger enforcement, or additional compensating measures.

Cloud Audit Logs is incorrect because it names a logging service rather than the central evaluation criterion for scheduled control revisions. Logs can provide useful evidence during a review but they do not replace a comprehensive assessment of risk and compliance alignment.

Waiting to update documentation only after a compliance fine has been issued is incorrect because that reactive stance increases legal and operational risk. Revisions should be proactive and based on ongoing risk assessment and compliance mapping instead of waiting for enforcement actions.

Updating controls based solely on informal staff suggestions is incorrect because control changes require formal governance, risk analysis, testing, and approval. Informal suggestions can inform improvements but they must be validated and integrated through the change control process before controls are modified.

Full AWS Practitioner Certification Question