The correct option is Prioritizing high value assets and the biggest threats using risk assessments.

This choice is correct because budget and staffing must be allocated to reduce the organizations greatest risks and to protect what matters most to the business. Risk assessments reveal which assets have the highest value and which threats pose the largest potential impact so that controls and personnel are applied where they will do the most good. Using a risk driven approach produces measurable prioritization and helps justify expenditures to leaders and stakeholders.

Cloud Security Command Center is incorrect because it names a specific tool rather than a budgeting principle. A tool can aid monitoring and detection but it does not by itself tell you how to prioritize spending across people and programs.

Purchasing every available security product is incorrect because buying everything is inefficient and often creates overlap and management burden. This approach wastes budget and can increase operational complexity rather than reduce the highest business risks.

Outsourcing all security responsibilities to external vendors is incorrect because vendors can supplement capabilities but they do not remove the organizations accountability for risk decisions. Outsourcing without risk based governance can leave gaps and misaligned priorities.

Full AWS Practitioner Certification Question