The correct answer is Accept the implemented control and document the divergence.

Choosing Accept the implemented control and document the divergence is appropriate when the assessor has determined that the installed safeguard provides equal or stronger protection than the one described in the security plan. The assessor should record the divergence and the rationale so that the system documentation and the authorization record reflect the actual protection implemented. Documentation provides an audit trail and supports ongoing risk management and future reviews.

Create a finding in Cloud Security Command Center is incorrect because a finding is intended for actual weaknesses or vulnerabilities that reduce security. If the implemented safeguard is equal or stronger there is no deficiency to report as a finding.

Require the system owner to modify the implementation to match the security plan is incorrect because forcing a change when the alternate implementation is equivalent or better can introduce unnecessary work and potential risk. The better practice is to document and accept the divergence and update the plan if appropriate.

Refer the discrepancy to the authorizing official for a formal determination is incorrect in routine cases where the assessor can determine equivalence. Escalation is appropriate if the assessor is uncertain or if the implementation weakens controls, but it is not required when the assessor has clearly determined the control is equal or stronger.

Full AWS Practitioner Certification Question