The correct answer is Prioritizing the organization's risk appetite and security goals.

This choice is correct because selecting controls for a high sensitivity data platform must begin with a clear understanding of the organization's risk tolerance and security objectives. A risk based approach identifies which threats and vulnerabilities are most relevant, clarifies regulatory and compliance obligations, and directs control selection so protections match the sensitivity of the data.

Prioritizing risk and goals also helps teams balance security, usability, and cost while ensuring controls are measurable and adjustable as threats or business needs evolve.

Leveraging Cloud IAM and Organization Policy controls is not the primary consideration because it names specific implementation mechanisms rather than the foundational decision. Cloud IAM and organization policies are effective tools to enforce decisions, but you must first determine which controls are required based on risk and objectives.

Minimizing the upfront and ongoing costs of security controls is not correct because cost alone should not drive protection for high sensitivity data. Cost is an important constraint, but making it the primary factor risks under protection and can produce far greater losses from breaches or compliance failures.

Deploying an extensive set of security controls regardless of necessity is not correct because indiscriminate application of controls creates complexity and operational burden and increases the chance of misconfiguration. Controls should be tailored to the identified risks and the value of the assets rather than applied uniformly without justification.

Full AWS Practitioner Certification Question