The correct option is Mapping and documenting personal data flows including unmanaged applications.

This is the right choice because privacy assessments focus on what personal data exists where and how it moves. The activity of mapping and documenting personal data flows including unmanaged applications requires discovery of data stores and tracking of transfers across owned systems and third party services. It also requires identifying shadow IT and unmanaged applications that may collect or process personal data without clear controls or contracts.

Privacy work must reconcile legal obligations for data minimization, retention, and cross border transfers with technical realities. That makes mapping and documenting personal data flows including unmanaged applications uniquely difficult because it combines process analysis, legal interpretation, and technical discovery across organizational boundaries.

Configuring network firewall rules is a network security task that helps control traffic but it does not by itself identify or document what personal data is collected or how it is used, so it is not a primary privacy assessment difficulty.

Managing encryption key lifecycles with Cloud KMS is an important security operation for protecting data at rest and in transit, but key management is an operational control rather than the core challenge of discovering and mapping personal data flows.

Provisioning Cloud Storage capacity for analytics workloads is an infrastructure planning task. It addresses storage sizing and performance needs and does not primarily involve identifying personal data locations or undocumented applications that affect privacy assessments.

Full AWS Practitioner Certification Question