The correct option is Continuously monitor suppliers for risks for the duration of the business relationship.

This choice is correct because supply chain risks can appear or change after the initial vendor selection and because hardware and firmware can be altered at any time in the supplier chain. Continuous monitoring enables timely detection of new vulnerabilities threats or changes in a supplier s security posture and it supports ongoing contract enforcement vulnerability management and incident readiness.

Conduct a single risk assessment only during vendor selection is incorrect because a one time assessment cannot capture changes that occur during the life of the relationship. New threats patches supplier subcontracting and configuration drift can introduce risk after the initial review.

Trust the vendor to self attest to their security controls without independent checks is incorrect because self attestations may be incomplete biased or out of date. Independent assessments audits and evidence based verification reduce the chance of undiscovered gaps or misrepresentations.

Start monitoring only after observing a security incident or breach is incorrect because that reactive approach means threats are detected too late. Proactive and continuous monitoring reduces detection time and the impact of supply chain compromises.

Full AWS Practitioner Certification Question