The correct answer is Multi factor authentication is enabled only for system administrators.

Multi factor authentication is enabled only for system administrators shows partial compliance because the control is applied to a limited group rather than to all users. Requiring MFA only for administrators reduces risk for privileged accounts but leaves the broader user population without the required protection so the security requirement is not fully satisfied.

Multi factor authentication is enforced for every user account is incorrect because it describes full compliance where every account meets the requirement rather than a partial implementation.

Encryption is applied to every archived backup set is incorrect because that example also represents full compliance for backup encryption and not a partial or limited enforcement.

VPC Service Controls is incorrect because it names a control service rather than illustrating a partially implemented requirement. It does not demonstrate limited scope such as applying a control to only some users.

Full AWS Practitioner Certification Question