They enable customers to verify that the supplier is operating the agreed upon security controls is the correct option.

Contractual audit provisions give the customer explicit rights to obtain evidence and to validate that the supplier has implemented and is maintaining the security controls that were agreed in the contract and the statement of work. These rights typically cover review of supporting documentation and reports and they may allow on site assessments or access to third party assurance reports so the customer can confirm the supplier is meeting its obligations and managing risk.

They grant customers ownership of the supplier's hosted data is incorrect because audit rights do not transfer legal ownership of data. Ownership and data residency must be negotiated separately and they require explicit contractual language that goes beyond simply allowing audits.

They remove the need for customers to use platform auditing services such as Cloud Audit Logs is incorrect because contractual audit rights and platform or cloud audit logs serve complementary purposes. Audit provisions allow verification and access to evidence while platform logs provide the technical telemetry that auditors and customers use to demonstrate and trace control operation.

They allow customers to withhold payment for services that do not meet their expectations is incorrect because audit rights establish verification and remediation paths and they may enable contractual remedies. Withholding payment is a separate contract remedy and it must be explicitly written into the agreement if it is to be permitted.

Full AWS Practitioner Certification Question