The correct option is A regional hospital network that stores about 120,000 patient medical records.

This choice is appropriate because the environment contains highly sensitive personal health information and a large number of records that would cause significant harm if exposed. Regulatory obligations and industry best practices place extra emphasis on protecting protected health information and on strong authentication for accounts that access or administer those systems. Implementing multi factor authentication reduces the risk of credential compromise and is therefore a highly warranted extra control for this scenario.

A Google Cloud QA project that hosts staging instances and contains no real customer data is less appropriate because the absence of real customer data lowers the confidentiality risk and other controls like network segmentation and access logging may be more cost effective.

A small landscaping firm that only publishes public brochure content is not a strong candidate because the published content is public and the sensitivity of held data is typically low, so MFA yields limited incremental protection for the primary business function.

An online retail promotion sending a seasonal email campaign to approximately 250,000 subscribers is also less appropriate in this context because the primary risk relates to marketing and deliverability rather than large volumes of highly sensitive records. Protecting marketing systems is important, but controls such as email authentication and secure campaign management are often more directly relevant than site wide MFA for this specific use case.

Full AWS Practitioner Certification Question