Create a detailed risk management program that covers cloud security assessments, compliance audits, and staff security training is correct. This option gives Meridian Outfitters a structured and repeatable way to identify compliance gaps and to balance security controls with business migration timelines.

The program should include cloud security assessments to map the provider shared responsibility model to Meridian Outfitters regulatory requirements and technical environment. It should include compliance audits to verify controls and to provide evidence for regulators. It should also include staff security training so that operational teams and developers understand cloud risks and apply secure configurations during and after migration.

Choose the cloud provider with the lowest price and optimize security after the migration is wrong because cost alone does not ensure required security controls or compliance coverage. Selecting a provider for price without verifying control mappings increases exposure during migration and can create costly remediation work later.

Hire a specialized cloud security managed service provider to perform the migration and handle security controls is not the best single answer because an external provider can help but does not remove Meridian Outfitters responsibility for governance and compliance. A managed service can be part of the risk management program but should not replace internal assessments, audits, and training.

Pause the cloud migration until every potential risk is fully identified and documented is impractical because migrations are subject to business timelines and risk can never be reduced to zero. A risk management program enables prioritized remediation and controls so migration can proceed safely with continuous monitoring and improvement.

Full AWS Practitioner Certification Question