The correct answer is Unnecessary complexity.

The economy of mechanism principle insists on minimizing Unnecessary complexity because simple and small designs are easier to analyze, verify, and test. Simplicity reduces the number of interactions and edge cases that can create vulnerabilities and it makes it easier to reason about security properties and to audit the system.

Minimizing Unnecessary complexity also reduces the attack surface and the likelihood of configuration or integration mistakes that can lead to breaches. A simpler design lowers the chance of hidden dependencies and unexpected behaviors that attackers can exploit.

Unauthorized access is a security outcome to prevent and not the specific focus of the economy of mechanism guideline. The principle is about how the system is designed rather than a single type of threat.

Cloud IAM is a concrete control model for identity and access management in cloud environments and it is not what the economy of mechanism guideline requires be minimized. The guideline applies to overall design complexity and architecture rather than one particular technology or control.

Software defects are often a consequence of complexity and reducing defects is a benefit of following the principle. The guideline however explicitly targets Unnecessary complexity in the design rather than naming defects as the thing to minimize.

Full AWS Practitioner Certification Question