The correct option is Choosing controls exclusively on the basis of cost efficiency.

Choosing controls exclusively on the basis of cost efficiency is not acceptable because security control selection must consider the threat landscape risk to assets compliance obligations and the required level of protection. Focusing only on cost can leave critical risks unaddressed and can result in noncompliance or unacceptable residual risk.

Adopting controls that align with recognized industry frameworks and best practices is a valid approach because frameworks provide vetted baselines and common controls that reduce risk and improve consistency across the organization.

Implementing controls that are mandated by statutes regulations or internal company policy is also valid because legal and policy requirements create binding obligations that organizations must meet to avoid penalties and protect stakeholders.

Using a structured risk assessment to inform which controls to implement is a proper method because it ties control selection to identified threats vulnerabilities and potential impacts and ensures resources are applied where they reduce the most risk.

Full AWS Practitioner Certification Question