The correct option is The required effort scales with the size and complexity of the IT environment and with control criticality.

Testing effort varies because larger and more complex environments contain more systems, interfaces, and configurations that must be evaluated. Higher criticality controls and more sensitive data demand deeper testing and more evidence. Other factors that influence effort include the number and diversity of technologies, regulatory and contractual requirements, the frequency of system changes, the maturity and automation of controls, and the interdependencies between systems. A risk based approach helps allocate effort where it matters most and allows sampling and continuous monitoring to reduce manual effort over time.

Security Command Center is incorrect because the question asks about how testing effort is determined and what factors influence it. A named product or tool does not answer the conceptual question about scaling and control criticality.

It is a one time activity performed only during the initial audit is incorrect because security control testing is ongoing. Controls need reassessment after changes, periodically for assurance, and as part of continuous monitoring rather than only at an initial audit.

Testing effort follows a fixed schedule that is applied equally to all systems is incorrect because a fixed, uniform schedule ignores differences in risk, criticality, and complexity. Applying the same level of effort to all systems is inefficient and can leave high risk areas under tested.

Full AWS Practitioner Certification Question