The correct answer is By showing decreased operational financial reputational and regulatory risks.

Senior executives respond to evidence that links security and governance activities to business outcomes. Presenting metrics that show reductions in operational incidents lower expected financial loss improved protection of reputation and reduced regulatory exposure makes the value of the program concrete and aligned with executive priorities.

Quantifying improvements with trends and expected loss calculations allows leaders to compare the program to other investments. Metrics that show fewer incidents lower remediation costs reduced likelihood of fines and preserved customer trust make a persuasive business case that supports continued funding and executive sponsorship.

By showing how audit trails and monitoring with Cloud Audit Logs improve oversight is incomplete as a primary persuasion point. Audit trails are useful for investigation and compliance but executives are motivated by business risk and measurable reductions in harm rather than by technical logging capabilities alone.

By emphasizing the technical complexity of the GRC implementation is counterproductive. Highlighting complexity tends to raise concerns about cost schedule and feasibility and it does not demonstrate business benefit or reduced risk which are the factors executives care about.

By arguing that GRC will primarily increase reporting workload for teams is also the wrong approach. Framing the program as additional burden focuses on costs and pain points and it will not persuade senior leaders who need to see risk reduction and business value.

Full AWS Practitioner Certification Question