To ensure that every configuration modification is planned reviewed approved and documented is correct.

A formal change control procedure ensures that configuration changes are planned tested reviewed and approved before they are implemented and that each change is documented for traceability and rollback. This process reduces the risk of accidental or insecure modifications, preserves secure baselines, supports audits, and assigns accountability for who requested and who authorized each change.

Cloud Audit Logs is incorrect because audit logs record events and can help detect or investigate changes after they occur but they do not by themselves provide the planning approval and documentation lifecycle that a change control process provides.

To prevent any modifications from being applied is incorrect because the goal of change control is not to block all change. The goal is to manage and authorize changes so they can be made safely and predictably while allowing necessary updates.

So that only senior executives can authorize changes is incorrect because requiring executive sign off for every configuration change is impractical and can delay critical fixes. Approval should be delegated to appropriate technical owners and managers who understand the impact and risk.

Full AWS Practitioner Certification Question