Conducting an architectural risk assessment is correct because this is the stage when the development team evaluates the security implications of the application's overall architecture and design.

Conducting an architectural risk assessment examines high level design decisions data flows trust boundaries and attack surfaces to identify architecture level vulnerabilities and necessary controls. This assessment is done early in the design phase so teams can change architecture and select appropriate mitigations before detailed implementation begins.

Cloud IAM policy design is incorrect because it focuses on identity and access control rules and permissions for cloud resources rather than evaluating the overall application architecture and design.

Modeling and classifying data is incorrect because it deals with identifying data types and sensitivity so protection requirements can be applied and it does not itself assess architecture level risks across the application.

Carrying out threat modeling is incorrect in this context because threat modeling is a complementary and often more granular activity that identifies threats to specific components or use cases. Threat modeling is valuable but it is normally performed as part of or after an architectural risk assessment rather than being the single stage that evaluates the entire architecture.

Full AWS Practitioner Certification Question