The correct option is Pushback from employees and system administrators.

This choice is correct because human resistance often prevents organizations from applying and maintaining uniform secure configurations across servers and applications. When staff or administrators prefer local control they may override centralized settings delay rollouts or apply informal tweaks. That ongoing pushback creates exceptions and fragmentation even when standards and tools exist because enforcement and buy in are missing.

Insufficient automation and lack of infrastructure as code is not the best answer because missing automation is a technical obstacle but it is usually a consequence of priorities and buy in. Once stakeholders support standardization teams will typically invest in automation and infrastructure as code to scale consistent configurations.

Absence of shared technical standards and baselines is not chosen because many organizations do have documented standards. The primary failure is often enforcement and adherence rather than the mere absence of written baselines.

Overly restrictive compliance obligations that slow change is not correct because compliance requirements more often push organizations toward uniform controls. Compliance can slow some changes but it typically creates incentives to standardize rather than to fragment configurations.

Full AWS Practitioner Certification Question