To ensure the chosen controls support organizational objectives and reflect a range of perspectives is correct.

This option is correct because selecting security controls is not only a technical task but also a governance and business decision. Involving representatives from several departments helps ensure controls align with business goals and risk tolerance. It also brings diverse perspectives on threats, impacts, and operational constraints which reduces blind spots and increases the chance of practical and effective controls.

Cross functional participation improves acceptance and implementation. When application owners, infrastructure teams, legal staff, and business managers all contribute there is clearer understanding of trade offs and dependencies. That reduces friction during deployment and helps ensure controls do not inadvertently block critical business processes.

To meet external regulatory and audit requirements is incorrect because while regulatory needs are important they are only one factor. The option states a narrow purpose and does not capture the primary reason which is achieving alignment with organizational objectives and diverse perspectives.

To keep a detailed audit trail of decisions and implementation steps is incorrect because maintaining an audit trail is a useful practice but it is a procedural outcome rather than the main reason to involve multiple departments. The question asks why representatives should take part in selecting controls and not how to document the selection process.

To validate technical feasibility with application owners and infrastructure engineers is incorrect because technical validation is necessary but it is only part of the selection process. Limiting participation to feasibility checks misses the broader need for business alignment and risk perspective that comes from including nontechnical stakeholders.

Full AWS Practitioner Certification Question