Managed centrally as a required SDL configuration is correct.

Central management ensures that the same compiler hardening flags and warnings are applied across all teams and build pipelines so behavior is consistent and reproducible. Making the flags a required part of the secure development lifecycle also makes them enforceable in CI and subject to audit and change control which supports long term maintenance and security posture.

In practice you implement the central configuration in your build system templates or platform policies and you enforce it in CI pipelines so developers cannot bypass required flags. This approach reduces lead to fewer environment specific issues and makes it easier to update or strengthen flags across the organization when new vulnerabilities or compiler options appear.

Allow individual developers to select flags per repository is wrong because it creates inconsistent build behavior and increases the chance that some repositories will lack important hardening options. Inconsistent flags make vulnerabilities harder to track and remediation more difficult.

Cloud Build is wrong because it is the name of a build service and not an answer about how compiler flags should be governed. Using a particular build tool does not by itself establish a required SDL configuration unless you explicitly apply centralized policies in that tool.

Restrict flags to a minimal set of critical checks to speed builds is wrong because trimming checks for speed reduces security and undermines the goal of consistent, secure builds. Performance can be optimized in other ways but critical hardening flags should remain enforced.

Full AWS Practitioner Certification Question