A process to report security and privacy posture to executives established is the correct option.

This item is typically an ongoing reporting and governance activity that occurs after controls are implemented and assessments are performed. The reporting process is part of continuous monitoring and stakeholder communication rather than the preparatory work that defines strategy and control mappings.

An organization wide strategy for continuous monitoring developed and implemented is incorrect because establishing a continuous monitoring strategy is a core outcome of the Prepare stage. The Prepare stage sets organization level approaches to monitoring so that effectiveness can be measured and sustained.

Common controls identified and mapped to business activities is incorrect because identifying and mapping common controls to business activities is a foundational Prepare activity. The mapping supports consistent control application and later assessment and monitoring.

An enterprise risk management strategy established and overall risk tolerance determined is incorrect because setting enterprise risk management approaches and defining risk tolerance are central Prepare tasks. Those elements guide control selection and prioritization across the program.

Full AWS Practitioner Certification Question