The correct answer is Ongoing control monitoring and scheduled reviews.

This approach ensures that controls are validated continuously and that their performance is compared to shifting threats and changing systems. Ongoing monitoring catches configuration drift and new vulnerabilities and it shows when controls stop working as intended so that remediation can be applied promptly. Scheduled reviews provide a formal cadence to reassess control effectiveness, update baselines, and align controls with policy and business changes.

Performing continuous vulnerability scanning and automated alerting is useful as part of a monitoring program but it focuses on detection and notification rather than the governance and periodic reassessment needed to maintain long term control effectiveness.

Updating security policies once every year is insufficient because the threat landscape and system configurations can change more frequently than annually and the controls that enforce policy need more regular validation and adjustment.

Conducting a single compliance audit immediately after deployment gives only a point in time snapshot. A one time audit will not reveal later drift, newly introduced risks, or control failures that occur during ongoing operation.

Full AWS Practitioner Certification Question