The correct answer is Confirm that deployed security controls function as intended and satisfy the organization's security requirements.

A security control evaluation is specifically intended to validate that controls are implemented correctly and that they operate effectively in the live environment. This activity matches Confirm that deployed security controls function as intended and satisfy the organization's security requirements because the evaluation uses tests and evidence to show the controls meet the defined security requirements and support authorization decisions.

Estimate the residual risk to the system after controls are implemented is incorrect because estimating residual risk is a risk assessment activity that quantifies remaining risk after controls are considered. It is related to control effectiveness but it is not the primary objective of a control evaluation.

Assess compliance with relevant laws regulatory frameworks and contractual security obligations is incorrect because compliance assessment focuses on alignment with external requirements. A control evaluation can produce evidence useful for compliance but its main aim is to verify operational effectiveness rather than to demonstrate regulatory compliance.

Detect vulnerabilities and weaknesses in the application environment is incorrect because finding vulnerabilities is the focus of vulnerability scanning and penetration testing. A control evaluation may reveal weaknesses in controls but its core purpose is to confirm that controls function as intended and meet requirements.

Full AWS Practitioner Certification Question