To implement alternate safeguards when the specified controls cannot be applied is the correct option.

To implement alternate safeguards when the specified controls cannot be applied correctly describes the purpose of compensating controls because they are used to provide an equivalent level of protection when the original, specified control cannot be implemented for technical, operational, or business reasons. Compensating controls must be documented, approved by the appropriate risk owners, tested, and shown to meet the same control objectives as the original control.

To remove regulatory compliance obligations is incorrect because compensating controls do not eliminate compliance requirements. They exist to meet control objectives when the specified control cannot be applied and they must still satisfy regulators and auditors.

To formally accept residual risk instead of applying controls is incorrect because risk acceptance is a separate management decision where an organization knowingly accepts the risk without additional mitigation. Compensating controls are implemented to reduce or mitigate the risk rather than to accept it.

To substitute every existing control with new technology is incorrect because compensating controls are targeted alternatives for specific controls and they do not imply wholesale replacement of all controls or that the alternative must be new technology. Compensating controls can be administrative, procedural, physical, or technical depending on what achieves equivalent protection.

Full AWS Practitioner Certification Question