A security controls assessment seeks to identify risks and vulnerabilities while a security controls audit evaluates the effectiveness of the implemented controls.

The assessment is a risk focused activity that aims to discover weaknesses in design and implementation so that teams can prioritize remediation. It commonly combines vulnerability scanning, configuration reviews, and manual examination to surface vulnerabilities and potential attack paths. The output is usually a set of findings and recommended mitigations that feed risk management and continuous improvement.

An audit concentrates on determining whether controls are operating as intended and whether they meet applicable requirements. Audits are evidence driven and assess control effectiveness and compliance with policies or standards. The report from an audit supports assurance needs for stakeholders and may be used for certification or regulatory purposes.

A security controls audit is a compliance oriented examination often conducted by external auditors is not the best choice because it frames audits only as compliance checks and only as external activities. Audits do often support compliance and may be performed by external parties, but the key distinction is that audits evaluate control effectiveness rather than simply labeling them as compliance tasks.

A security controls assessment is usually manual and exploratory while a security controls audit is often carried out using automated tools such as Security Command Center is incorrect because both assessments and audits can use a mix of manual techniques and automated tools. Tools can aid either activity but they do not define the fundamental difference, which is assessment for finding risks and audit for evaluating control effectiveness.

A security controls assessment always takes place before system authorization and a security controls audit always takes place after authorization is incorrect because neither activity is strictly confined to before or after authorization. Assessments occur throughout development and operations and audits can be performed at multiple lifecycle stages including during authorization and as part of ongoing assurance.

Full AWS Practitioner Certification Question