Decommissioning a service that handles confidential customer records is the correct option because it removes the asset and activity that create the risk and therefore represents risk avoidance.

Risk avoidance means not engaging in the activity that generates the threat or exposure. By taking the service out of operation and eliminating the processing of those confidential records the firm removes the possibility of breaches tied to that service rather than accepting or reducing the exposure.

Outsourcing a high risk function to an external vendor is incorrect because outsourcing typically transfers or shares risk with a third party instead of eliminating the risk. The firm remains exposed through vendor relationships and must manage third party risk.

Buying a cybersecurity insurance policy to cover potential breach losses is incorrect because insurance is a form of risk transfer and financial protection. It does not remove the underlying vulnerability or prevent incidents from occurring.

Implementing layered security controls and continuous monitoring to reduce vulnerabilities is incorrect because those actions are risk mitigation. They reduce the likelihood or impact of incidents but do not avoid the risk by removing the activity or asset entirely.

Full AWS Practitioner Certification Question