The correct option is Evaluating controls through testing and measurement.

Control selection is primarily about choosing which security controls are needed, tailoring baselines to the system, and mapping those controls to system components and responsibilities. Evaluation through testing and measurement is an assessment activity that verifies whether implemented controls are effective and it normally happens after controls are implemented and operating.

Assigning controls to system components is part of the selection and design work because teams must decide which components will host or enforce each control and document those assignments as part of the control selection and implementation plan.

Implementing Cloud Audit Logs and Cloud Monitoring configurations can read as an implementation task but in the control selection phase teams typically specify logging and monitoring requirements and desired configurations so that implementation can follow. Defining those logging and monitoring controls is therefore consistent with control selection.

Customizing baseline controls to match system requirements is a core selection activity because baselines are tailored to the system environment and risk profile during the selection and design phase.

Full AWS Practitioner Certification Question