The correct option is System owner.

The System owner is accountable for the information system and for determining its security classification and categorization based on the sensitivity of the data and the business impact. The System owner coordinates with data owners and security staff to evaluate confidentiality integrity and availability impacts and then assigns the appropriate classification for that system.

Chief risk officer is an enterprise role that sets risk management policy and oversees organizational risk posture. The Chief risk officer does not typically assign system level classifications or perform system specific classification decisions.

System security officer is responsible for implementing and maintaining technical and operational security controls and for day to day security operations. The System security officer supports classification and controls but does not have the primary duty to set the system classification.

Designated authorizing official reviews system security and formally authorizes or accepts residual risk for system operation. The Designated authorizing official authorizes operation and accepts risk but does not normally assign the security classification.

Full AWS Practitioner Certification Question