The correct option is FIPS 199 and NIST Special Publication 800-60 establish security categorization and impact guidance that drive control selection from NIST Special Publication 800-53.

FIPS 199 defines security categories by considering confidentiality, integrity, and availability and it assigns impact levels such as low, moderate, or high. Those definitions form the foundational framework for determining how critical an information type or system is.

NIST Special Publication 800-60 provides practical guidance for mapping specific information types to the impact levels defined in FIPS 199. This mapping ensures consistent categorization across different types of data and systems and supports informed decision making.

NIST Special Publication 800-53 contains the catalog of security and privacy controls that organizations select and tailor based on the security categorization established by FIPS 199 and the mapping guidance from SP 800-60. In practice the categorization and mapping drive which baseline controls are chosen and how they are implemented.

FIPS 199 prescribes specific technical controls for systems is incorrect. FIPS 199 establishes security categories and impact levels and it does not specify technical controls. The controls themselves are provided in NIST SP 800-53.

NIST Special Publication 800-53 sets impact categories for different information types is incorrect. SP 800-53 provides control families and detailed controls for protecting systems and information. Impact categories are defined by FIPS 199 and SP 800-60 helps map information types to those categories.

NIST Special Publication 800-60 replaces the need for FIPS 199 is incorrect. SP 800-60 complements FIPS 199 by giving mapping guidance and examples but it does not replace the standard definitions in FIPS 199 which remain the baseline for security categorization.

Full AWS Practitioner Certification Question