Data minimization is correct because it is the privacy principle that requires companies to collect use and and retain personal information only to the extent necessary for the intended purpose.

This principle focuses on limiting the scope of data collection and retention so that only data needed for the stated purpose is held. Implementing this principle means defining clear purposes applying retention schedules anonymizing or deleting unnecessary records and avoiding surplus data collection. Following this approach reduces privacy risk and supports regulatory requirements that demand purpose limitation and limited retention.

Cloud Key Management Service is wrong because it is a key management product that protects data through encryption and key lifecycle controls. It does not by itself restrict how much personal data an organization collects uses or retains.

Identity and Access Management is wrong because it controls who can access resources and what actions they can take. It improves security and enforces least privilege but it does not require limiting data collection or retention to what is necessary for a purpose.

Cloud Audit Logs is wrong because logs provide visibility and an audit trail of actions and events. They help with accountability and forensics but they do not impose limits on collecting using or retaining personal information in the way that data minimization does.

Full AWS Practitioner Certification Question