Grant access only to authorized personnel using role based permissions is correct.

Grant access only to authorized personnel using role based permissions implements the principle of least privilege and lets you give log read rights only to the teams that need them for operations and incident response. Role based permissions also make it possible to audit who accessed logs and to remove access quickly when roles change.

Make operational logs available to every employee is wrong because broad access increases the chance of accidental exposure and makes it harder to track who viewed sensitive records. Logs often contain system and user activity that should be restricted to reduce risk.

Cloud Audit Logs is wrong because it names a logging service rather than an access policy. The question asks who should be granted access so a service name does not answer the access control requirement.

Allow individual users to view logs so they can verify their own actions is wrong because giving every user direct log access undermines least privilege and can expose sensitive operational details. Users who need verification should use controlled tools or request access through authorized channels.

Full AWS Practitioner Certification Question