How effectively the compensating controls reduce the identified risk is the correct consideration to drive the choice of compensating controls.

Compensating controls must materially lower the likelihood or impact of the vulnerability so that the residual risk is acceptable. They should provide demonstrable and testable mitigation and they should be documented so stakeholders can verify that the identified risk has been addressed.

The effectiveness discussion includes monitoring and testing so the organization can confirm the compensating control continues to work over time and does not introduce unacceptable secondary risks.

Regulatory and compliance obligations are important and may constrain which controls are allowed, but they are not the primary driver when choosing compensating controls. The main requirement is that the control actually reduces the identified risk.

The cost to implement the compensating controls can influence what is feasible and what timeline is practical, but cost alone does not justify a control that fails to mitigate the risk.

Compatibility with the existing infrastructure and operational feasibility matter for implementation and maintenance, but they are secondary to whether the control effectively reduces the risk that was identified.

Full AWS Practitioner Certification Question