The correct option is To protect critical secrets by dividing them into shares that require multiple parties to reconstruct the secret.

The approach described by To protect critical secrets by dividing them into shares that require multiple parties to reconstruct the secret is commonly implemented as a threshold secret sharing scheme. In this model a secret is split into multiple shares and a predefined number of shares are required to reconstruct the original secret. This reduces the risk that a lone staff member can expose or misuse the full secret because no single share by itself reveals the secret.

Implementing To protect critical secrets by dividing them into shares that require multiple parties to reconstruct the secret provides both confidentiality and operational controls. It enforces split knowledge where custodians hold partial information and it provides a clear recovery path when a quorum of authorized parties cooperates to rebuild the key or credential.

To let staff use a single set of credentials to access many systems is incorrect because that pattern increases single person risk and credential reuse rather than reducing the chance of a lone staff member exposing critical secrets.

Cloud Key Management Service is incorrect because it names a type of managed service rather than describing the purpose of secret sharing and split knowledge. A cloud KMS may include access controls or HSMs but the option does not explain the protective mechanism of dividing secrets into shares.

To split operational duties among team members so no one person can unilaterally misuse privileges is incorrect as stated because it describes separation of duties rather than the specific cryptographic technique of splitting a secret into shares. Separation of duties is a complementary control but it does not by itself implement the threshold reconstruction described in the correct option.

Full AWS Practitioner Certification Question