The correct options are Retained backups and archives and Software installed on devices.

Retained backups and archives must be identified and handled when software is retired because backups often contain the same sensitive data as the active system and they can persist long after the application is gone. Backups and archives should be deleted, migrated, or sanitized according to retention and legal requirements to prevent unauthorized access to historical data.

Software installed on devices needs to be removed or disabled as part of disposal to prevent orphaned agents, unused credentials, and licensing issues. Uninstalling the software and cleaning up configuration files and service accounts reduces attack surface and avoids unexpected costs or compliance gaps.

Cloud hosted datasets is not correct because cloud data is managed under its own lifecycle and removal is not automatically part of retiring a software package unless the question explicitly includes cloud resources. Handling cloud datasets requires separate actions and permissions and is often governed by different policies.

Decommissioned physical equipment is not correct because the question asks about retiring software and hardware disposal is a separate process. Physical decommissioning and media sanitization are important but they belong to asset disposal procedures rather than the software retirement checklist unless the hardware is directly being retired at the same time.

Full AWS Practitioner Certification Question