Perform a verified secure wipe using approved sanitization or cryptographic erasure methods is correct.

This option is correct because a secure wipe or approved sanitization method removes data from storage in a verifiable way so that sensitive information such as payment card numbers and national identification numbers cannot be recovered. Verification is important because it provides evidence that the sanitization completed successfully and it supports compliance with legal and regulatory requirements. When full disk encryption was used, cryptographic erasure by securely destroying the encryption keys is also an approved and efficient method to render data unrecoverable.

Keep the system intact in case the data is needed later is wrong because retaining the system preserves the sensitive data and increases the risk of unauthorized access. Disposal planning should follow retention policies and secure sanitization rather than keeping devices indefinitely.

Use Cloud Data Loss Prevention to identify and mask or tokenize sensitive fields is wrong because cloud data loss prevention tools help find and protect data in cloud or application environments and they do not by themselves sanitize or erase data on physical devices being retired. Masking or tokenization protects data for use cases but does not replace device sanitization before disposal.

Create an encrypted backup of the data before retiring the system is wrong because creating an additional copy extends the lifetime of sensitive data and increases risk unless there is a strict business need and the backup is subject to the same secure handling and disposal practices. Backups must be minimized and sanitized or destroyed when no longer required.

Full AWS Practitioner Certification Question