The correct answer is To inform employees about the company's security policies procedures and recommended practices and to reinforce their responsibility for protecting organizational assets.

This option describes the broad purpose of periodic security awareness training because it emphasizes informing staff about what the rules and expectations are and why they matter. Training communicates policies and procedures and reinforces individual responsibility so employees know how to act and how to report issues.

Regular awareness efforts also help embed security into daily work by reinforcing recommended practices and by clarifying roles and reporting channels. Repeat exposure increases retention and helps make secure behaviors habitual.

To meet legal and regulatory requirements is not the main purpose in this context. Compliance can drive awareness programs but the primary goal is to educate and reinforce responsibility rather than only to satisfy a regulatory checkbox.

To enable personnel to create the organization's security policies and procedures is incorrect because drafting policies is a governance and management responsibility. Training equips employees to follow and support policies but it does not make them the authors of the organization’s formal controls.

To lower the incidence of successful phishing and social engineering attacks through better user behavior is not selected as the main purpose here. Reducing phishing and social engineering is a valuable outcome of awareness training but the stated primary purpose is the broader task of informing staff about policies, procedures, recommended practices and reinforcing responsibility.

Full AWS Practitioner Certification Question