Risk appetite specifies how much and what kinds of risk a company will accept or retain is correct.

Risk appetite is a governance statement that sets the boundaries for acceptable risk and guides decision making. It helps leaders decide which risks to accept, which to mitigate, and which to transfer or avoid. The statement does not list specific technical solutions but it shapes policies, risk tolerances, and the overall risk posture that programs and controls must follow.

Cloud Security Command Center is incorrect because it names a specific security product and not a statement of organizational risk appetite. A product can support controls but it does not define how much risk the organization will accept.

Risk appetite prescribes the exact technical controls to implement is incorrect because an appetite sets limits and priorities rather than mandating specific technical implementations. Technical controls are selected through risk assessment, architecture, and resource decisions that are informed by the appetite.

Risk appetite lists risk categories that can be ignored completely is incorrect because appetite does not permit wholesale ignoring of categories. It defines what levels of risk are acceptable and what require action, and even low priority risks are usually monitored and reviewed.

Full AWS Practitioner Certification Question