The correct answer is Guide risk management by assessing the potential adverse impact to confidentiality integrity or availability of the system and its data.

Security categorization assigns impact levels for confidentiality integrity and availability and those impact levels are used to guide risk management decisions. The categorization step defines how severe adverse effects would be if the system or its data were compromised and that assessment drives prioritization and risk treatment choices.

Standards like FIPS 199 and associated NIST guidance make clear that categorization is about assessing potential adverse impact and informing the overall risk management process rather than performing control testing or ongoing monitoring.

Support continuous monitoring and operational awareness of the system's security and privacy posture is incorrect because continuous monitoring is an ongoing activity that relies on implemented controls and telemetry and it is not the primary purpose of initial security categorization.

Determine whether security controls are implemented correctly and achieve their intended outcomes is incorrect because that describes security assessment and testing activities which occur after controls have been selected and implemented rather than the categorization step.

Inform the selection and tailoring of security controls and baselines for the system is incorrect as the primary objective because informing control selection is a downstream use of the impact assessment. The selection and tailoring of controls follow categorization but they are not the fundamental reason for assigning the security category.

Full AWS Practitioner Certification Question