The correct answer is Restricting local production access for operations personnel.

Restricting local production access for operations personnel can create an operational barrier that motivates a technician to seek unauthorized workarounds with staff in other departments. If an operations person cannot perform necessary production tasks they may ask a colleague with access to act on their behalf or share credentials, and those interactions can turn into collusion to gain access to protected information.

Restricting local production access for operations personnel is a legitimate security measure when implemented as part of least privilege, but it must be paired with approved access workflows, just in time privileged access, strong auditing, and clear escalation paths. Those compensating controls reduce the incentive for technicians to conspire.

Periodic rotation of operations staff between teams is designed to reduce fraud and knowledge hoarding. Rotating staff makes long term collusion harder and it does not create the specific access barrier that would push someone to conspire with another department.

Enforcing mandatory password expiration policies can be inconvenient and may encourage poor practices like written notes, but it does not directly prevent an operations person from performing production tasks and so it is not the control most likely to induce collusion to obtain access.

Ongoing review of Cloud Audit Logs is a detective and deterrent control because it increases the likelihood of detection and accountability. Regular log review discourages collusion rather than encouraging it.

Full AWS Practitioner Certification Question