The correct option is Deploy strong access controls, audit logs, controlled physical access and administrative procedures.

This choice matches the HIPAA Security Rule because it covers the three required safeguard categories. Strong access controls and audit logs are technical safeguards that enforce least privilege and provide monitoring for unauthorized access. Controlled physical access protects servers, backup media, and paper records at the clinic sites. Administrative procedures such as policies, workforce training, risk assessments, and business associate agreements establish governance and incident response.

Limit controls to email encryption only is incorrect because email encryption addresses only one technical control and does not satisfy the administrative and physical safeguard requirements that HIPAA demands.

Implement only technical protections such as firewalls and endpoint security is incorrect because technical measures alone are not sufficient. HIPAA also requires documented administrative actions and physical safeguards to manage risk and protect patient records.

Rely exclusively on Cloud IAM and logging without physical safeguards is incorrect because cloud identity controls and logs help but they do not replace the need for physical protections and organizational policies. Covered entities remain responsible for physical security and proper business associate agreements with cloud providers.

Full AWS Practitioner Certification Question