Data residency and jurisdictional requirements is the correct option for Marcus to prioritize in his cloud security strategy.

When customer records are stored and processed across multiple continents governments and regulators can impose rules about where data must be kept and which legal systems can access it. These rules create legal risks that are separate from technical controls and they can force changes to data placement encryption and contract terms to remain compliant.

Identity and Access Management is important for controlling who can access systems and data but it does not directly address the legal question of which country has authority over the data.

Network security monitoring and intrusion detection provide detection and response capabilities that help protect data from breaches but they do not resolve jurisdictional obligations or cross border transfer restrictions.

Service level agreement obligations cover availability performance and some contractual liabilities and they are important for operations but they are not the primary legal risk when the concern is where customer records may lawfully be stored or accessed.

Full AWS Practitioner Certification Question