The correct answer is Because vendor risk profiles can shift rapidly as threats evolve and vendors change their systems.

This answer is correct because third party vendor risk is not static. Threat actors and attack techniques change over time and vendors can update infrastructure and services in ways that introduce new weaknesses. Continuous monitoring detects those shifts early so the bank can respond before an incident affects customers or operations.

Ongoing monitoring also tracks operational performance and control effectiveness against service level agreements and security expectations. Regular checks reveal configuration drift, missing patches, or weakened access controls so issues can be remediated quickly and documented for risk committees and regulators.

Cloud Security Command Center is incorrect because it names a specific security product and not a reason why a bank should continually monitor vendors. It may be a useful tool in some environments but the question asks for the rationale behind continuous vendor monitoring rather than a product recommendation.

One time vendor assessment during onboarding is sufficient to manage future risk is wrong because a single assessment captures only a point in time. Vendors and threat landscapes change after onboarding so relying solely on an initial review misses later vulnerabilities and control failures.

Ongoing checks are unnecessary because regulatory audits guarantee security is incorrect because audits are periodic and focus on compliance evidence rather than continuous protection. Regulatory reviews do not prevent new vulnerabilities from emerging and they do not replace the need for real time or frequent monitoring.

Full AWS Practitioner Certification Question