The correct answer is Verifying that the security controls are achieving their risk reduction objectives.

Monitoring is primarily about assessing outcomes and ensuring that controls deliver the intended reduction in risk over time. Evidence such as test results, metrics, control performance data, and incident trends indicate whether Verifying that the security controls are achieving their risk reduction objectives is being met and guide decisions about tuning or adding controls.

Focusing on risk reduction ties monitoring to the organization s risk acceptance decisions and priorities. If controls exist but do not materially reduce risk then leaders must accept residual risk or require further mitigation.

Confirming that all planned security controls have been deployed is a necessary step after implementation but it only shows presence. Deployment alone does not prove that a control is effective or that it reduces the targeted risk.

Ensuring controls align with applicable compliance and regulatory requirements is important for legal and policy reasons. Compliance alignment does not always equate to actual risk reduction and it can miss organization specific threats or design flaws.

Making sure the controls are manageable and support automation of routine tasks improves operations and sustainability. Manageability and automation are valuable but they are secondary to assessing whether controls actually achieve their risk reduction objectives.

Full AWS Practitioner Certification Question