Conduct a targeted risk assessment and implement strengthened security controls for the vendor services is the correct option.

The appropriate immediate step is to perform a focused risk assessment and to harden the vendor relationship while facts are gathered. A targeted risk assessment and strengthened security controls lets the organization determine the scope of exposure by reviewing logs and configurations and by validating whether any data access actually occurred. This approach enables containment actions that preserve evidence and maintain business continuity while the vendor and the organization remediate gaps and add compensating controls such as enhanced monitoring, encryption, access revocation, and network segmentation.

Notify regulators and affected customers immediately is not the best immediate move because notification obligations are normally triggered by confirmed or legally defined data breaches. Premature public disclosure can cause unnecessary panic and may impede forensic work. The organization should gather evidence and consult legal and compliance teams to determine whether notification thresholds have been met.

Terminate the provider contract without delay is also inappropriate as an immediate action. Abrupt termination can interrupt critical services, hinder forensic investigations, and destroy logs or other evidence. Contract termination may be necessary later depending on findings, but it should follow a considered risk and business impact assessment and a migration plan.

Pause all data synchronizations to the vendor pending investigation is usually too blunt and may disrupt operations and complicate analysis. A targeted control posture is preferable. For example pause nonessential synchronizations or restrict sensitive data flows while maintaining access to logs and systems needed for investigation and remediation.

Full AWS Practitioner Certification Question