Legal and regulatory compliance is not listed as a security control family in NIST SP 800-53.

NIST organizes controls into named families such as Access Control, Audit and Accountability, and Configuration Management. The idea of legal and regulatory compliance is a policy and governance requirement that is addressed across multiple families and through organizational processes rather than being a separate, named control family. That is why Legal and regulatory compliance is the correct choice.

Configuration and change management is incorrect because NIST includes a Configuration Management family that covers baseline configuration, change control, and related activities.

Audit and accountability is incorrect because Audit and Accountability is an explicit control family that defines logging, monitoring, and audit review controls.

Human resources security is incorrect because NIST includes Personnel Security controls that cover hiring, personnel screening, role changes, and terminations and this human resources focus appears as a named family even if the wording can vary.

Full AWS Practitioner Certification Question