Data download or copying to the endpoint is the correct choice because it creates the largest and most persistent data security risk when a user is working remotely with an unreliable VPN.

When a user performs Data download or copying to the endpoint sensitive information is removed from the controlled corporate environment and placed on a device that may be unmanaged or inadequately protected. Once data exists on the endpoint it is far harder to enforce access controls or Data Loss Prevention and it can be retained, shared, or exfiltrated without corporate visibility.

Data remanence is not the best answer because it refers to residual information left on storage after deletion and is mainly a concern for media sanitization or decommissioning rather than the active risk of a remote user copying files to their device.

Use of unauthorized cloud file sharing is a meaningful risk but it is less directly aligned with the scenario. The question highlights slow internal access and a local download bypasses corporate controls more immediately than moving data to an unsanctioned cloud service in many remote work situations.

Data displayed or output on the screen can lead to transient exposures such as shoulder surfing or screenshots but it does not produce the same persistent, portable copies that downloading or copying to the endpoint does and so it poses a lower long term exfiltration risk in this context.

Full AWS Practitioner Certification Question