Stopping the task that produces the exposure is correct because it eliminates the activity that creates the risk and therefore removes the exposure rather than managing it.

This is classic risk avoidance. By discontinuing the task there is no asset or process left exposed and no need to rely on controls, insurance, or acceptance. Organizations choose avoidance when the risk is unacceptable or when other treatments are impractical.

Implementing controls to reduce the likelihood or impact of the risk is incorrect because that describes risk mitigation. Mitigation reduces the chance or impact of an event but it does not remove the activity that causes the exposure.

Shifting responsibility to a third party vendor is incorrect because that is risk transfer. Transfer moves responsibility or financial burden but the underlying exposure typically remains and residual risk can persist.

Choosing to accept the potential outcome without taking measures is incorrect because that is risk acceptance. Acceptance acknowledges the risk and tolerates its consequences without implementing controls or stopping the activity.

Full AWS Practitioner Certification Question