The correct option is Evaluating the ongoing effectiveness of controls.

Evaluating the ongoing effectiveness of controls refers to continuous monitoring and assessment activities that occur after controls are selected and implemented. Choosing and tailoring controls focuses on planning steps such as picking a baseline and adjusting it to the organization, while evaluation is an operational activity to measure whether those controls remain effective over time.

Mapping controls to specific compliance requirements is incorrect because mapping is part of the tailoring process. Organizations align controls to legal and regulatory requirements during selection and tailoring to ensure coverage and to identify gaps.

Selecting an initial control baseline from a standard catalog is incorrect because selecting a baseline is the typical first step in control selection. Baselines provide the starting point that is then tailored to the organization.

Adapting the baseline control set to fit the organization is incorrect because adapting the baseline is the essence of tailoring. Tailoring includes scoping, scoping exceptions, overlays, and compensating controls to produce a fit for purpose control set.

Full AWS Practitioner Certification Question