The correct option is Assess the security controls for effectiveness.

Assess the security controls for effectiveness is not part of the implementation phase because assessment is a separate RMF step that occurs after controls are implemented. The assessment step evaluates whether the implemented controls behave as intended and meet the security requirements.

Configure Identity and Access Management roles and permissions is an implementation task because it involves configuring the system and its components to enforce access control requirements.

Apply the selected security controls to the information system is the core activity of the implementation phase because it covers deploying and configuring the controls chosen for the system.

Choose the baseline set of controls for the system is part of the control selection step and happens before implementation when you determine which baseline or tailoring is appropriate for the system.

Full AWS Practitioner Certification Question