Include security mechanisms when they are reachable from public networks is correct.

Industrial control systems like SCADA were typically built for a single purpose and they often lack protections assumed in IT environments. When these systems are reachable from the Internet they must provide security mechanisms such as strong authentication, encryption, network segmentation, access controls, timely patching, and continuous monitoring so that remote reachability does not allow unauthorized commands or unsafe manipulation of physical processes.

Practical controls for exposed systems include secure remote access gateways or jump hosts, VPNs, least privilege for accounts, strict firewall and protocol filtering rules, and logging and intrusion detection tailored to industrial protocols. These measures address the increased attack surface that comes from Internet exposure.

Provide an intuitive operator interface that makes field control straightforward is incorrect because ease of operator use is a design goal but it does not address the specific requirement created by Internet exposure. The question asks what capability must be provided when systems are reachable externally and that is security.

Use Cloud Pub/Sub is incorrect because Cloud Pub/Sub is a specific cloud messaging service and it is not a required capability for SCADA systems when they are exposed to public networks. Security mechanisms are required regardless of the messaging or cloud technologies used.

Maintain physical or logical links to the sensors and actuators they supervise is incorrect because maintaining links to sensors and actuators is a core functional requirement of any control system. It does not answer what additional capability is required when the system is reachable from external networks.

Full AWS Practitioner Certification Question