Maintain comprehensive transfer records and audit logs is the correct choice because it produces an auditable chain of custody for builds as they move between test and production environments.

Maintain comprehensive transfer records and audit logs provides timestamps, actor identifiers, transfer receipts, and checksum or hash verification entries that together document who handled the artifact when and how. These records allow an auditor or investigator to reconstruct the custody path and detect or prove tampering during transfer. Implementing immutable or append only logging, secure storage of receipts, and automated checksum validation during each transfer makes this a practical and verifiable control.

Apply cryptographic code signing and digital signatures to the artifacts is useful for proving origin and for validating that an artifact was not altered, but signing alone does not record the sequence of hands and transfers that constitute chain of custody. Signing complements audit logs but it does not replace transfer records for custody verification.

Conduct regular vulnerability scans on the receiving environment improves the security posture of the target system, but it does not provide evidence of who transferred the build or of the custody chain during movement between environments. Scans do not prove pedigree or transfer history.

Verify the sender's reputation and historical behavior can help assess trust but it is an imprecise and nonauditable control for chain of custody. Reputation checks do not produce the concrete, time stamped records needed to prove which entity actually handled the artifact during a transfer.

Full AWS Practitioner Certification Question