A comprehensive set of executive responsibilities for overseeing and directing risk management is correct because risk governance defines who at the executive and board level is accountable for risk oversight, how authority is delegated, and how risk decisions align with organizational strategy.

Risk governance assigns accountability, sets the risk appetite, establishes reporting and escalation paths, and ensures there is independent oversight of risk management activities. It is a leadership and oversight function rather than a set of operational steps.

Regulatory requirements and external compliance obligations is incorrect because those items are external drivers and constraints that the governance framework must consider, but they do not themselves constitute the governance structure.

The formal process for making risk related decisions across the business is incorrect because that phrasing describes risk management processes and decision making at the operational level rather than the executive responsibilities and oversight that characterize governance.

Specific measures implemented to reduce identified risks is incorrect because those are controls and risk treatments. They are part of risk response and implementation rather than the executive oversight and accountability provided by governance.

Full AWS Practitioner Certification Question