Lowered costs from security incidents is correct because an information security management system is intended to identify and manage information risks so that the frequency and impact of security incidents is reduced and remediation and recovery costs are lowered.

An ISMS uses risk assessment, selected controls, monitoring and continual improvement to prevent or limit incidents. These activities reduce direct costs such as incident response and system recovery and indirect costs such as regulatory fines, lost revenue and reputational damage.

Higher customer satisfaction is not the primary advantage. Strong security can improve customer trust but that is a secondary benefit rather than the main purpose of an ISMS.

Expanded market presence is not the primary advantage. Certification or demonstrable controls can support marketability in some cases but the core aim remains managing information risk and protecting assets.

Improved employee engagement is not the primary advantage. An ISMS can raise awareness and involvement but the main focus is on reducing incidents and their costs.

Full AWS Practitioner Certification Question