Implementing only the strictest possible security controls across all systems is not a recommended approach when deploying security controls in an organization.

Implementing only the strictest possible security controls across all systems is problematic because it ignores context and business needs. Security should be risk based and proportionate to the value and sensitivity of assets and the operational impact on users. Applying the strictest controls everywhere can create unnecessary complexity and outages and it can lead to workarounds that reduce overall security.

Mapping security controls to the organization specific risk profile and operational needs is a recommended practice because it ensures controls address the actual threats and business priorities. Tailoring controls in this way improves effectiveness and reduces unnecessary burden on operations.

Using VPC Service Controls is a valid control for protecting cloud resources and controlling data exfiltration in supported environments. It represents a specific technical control that aligns with a layered and risk informed defense strategy.

Periodically auditing and updating security controls to address new threats is recommended because threats and technology change over time. Regular review and adjustments keep controls effective and ensure they continue to meet the organization needs.

Full AWS Practitioner Certification Question