Gaps in historical change records for systems is the correct option.

Gaps in historical change records for systems make retiring security controls difficult because teams cannot reliably determine why a control was put in place or what other systems depend on it. Without a clear change history engineers must spend time rediscovering past configurations and compensating controls which slows retirement and increases the chance of introducing new risks or outages.

Overly granular configuration inventories that impede progress is not the best answer because detailed inventories usually help identify where controls live and what to retire. Granularity may slow analysis but it does not create the same uncertainty as missing historical change records.

Undocumented IAM bindings on legacy projects is a real operational issue but it is a specific example of poor record keeping. The broader and more common obstacle is the overall lack of historical change records that would include IAM bindings and many other kinds of configuration changes.

Frequent overlapping compliance audits can complicate timing and coordination but audits often force documentation and review. They are an organizational scheduling problem and not the primary technical obstacle that missing change histories create when attempting to retire controls.

Full AWS Practitioner Certification Question