The correct option is A blend of the company's internal controls and cloud specific controls.

This option is correct because cloud adoption does not remove the need for the organization to maintain its governance and internal controls and it also introduces cloud native risks that require cloud specific controls. The shared responsibility model means some controls remain the organization's duty while others are provided or supported by the cloud vendor. A blended approach lets the company keep its policy, identity governance, and compliance frameworks and also apply cloud specific measures such as native IAM, network segmentation, encryption at rest and in transit, and provider logging and monitoring.

Practical implementation requires mapping existing controls to cloud services and adjusting them where they do not apply. You should assess risks, identify which controls must be retained or adapted, and add cloud specific controls for areas like identity, network isolation, and visibility. This produces a comprehensive posture rather than gaps or duplication.

Cloud IAM and VPC Service Controls is incorrect because focusing only on specific cloud services is too narrow. Those controls are useful but they do not address governance, policy, or legacy compliance requirements that the organization must still manage.

Only the cloud vendor's out-of-the-box controls is incorrect because vendor defaults rarely match an organization’s risk profile or compliance needs. Relying solely on provider defaults can leave gaps in configuration, data governance, and operational practices that the organization remains responsible for.

The organization's legacy security controls without change is incorrect because controls designed for on-premises environments often do not translate directly to cloud architectures. Legacy controls may assume network perimeter enforcement and physical hardware control and they need to be redesigned or augmented to work effectively in a cloud model.

Full AWS Practitioner Certification Question