Address different facets of protection is the correct option.

Access control models describe different facets of protection because they define the conceptual ways to decide who can do what under which conditions. Examples include discretionary access control mandatory access control role based access control and attribute based access control. These models guide how policies are expressed and how enforcement mechanisms should be designed to protect confidentiality integrity availability and separation of duties.

Act as general policy frameworks is incorrect because models are not merely vague frameworks. They provide specific patterns for how access decisions are made and enforced and they inform policy rather than replace it.

Map to authentication and authorization mechanisms is incorrect because models are conceptual approaches to authorization and they do not directly map to authentication. Authentication establishes identity and authorization implements the model. The model guides authorization design but it is not the same as the mechanisms used for authentication.

Identify single points of failure is incorrect because access control models are about decision logic and policy scope. Whether a particular implementation has a single point of failure depends on architecture and deployment choices rather than the model itself.

Full AWS Practitioner Certification Question