Prioritizing a thorough inventory of all IT assets is correct because it directly expresses the principle that you cannot protect what you do not know about.

A complete inventory gives the visibility required to identify and classify hardware software and cloud services so that risk assessments patching monitoring and access controls can be applied where they are needed.

Investing in Cloud Security Command Center is incorrect because this is a specific product that can help with cloud visibility but it does not capture the general practice of cataloging all assets across the enterprise.

Emphasizing hiring highly specialized security engineers is incorrect because skilled personnel are important but the saying is about discovering and knowing assets first rather than relying on staffing alone.

Focusing only on physical security controls is incorrect because that approach misses software configurations cloud resources and other nonphysical assets and the principle applies to all asset types.

Full AWS Practitioner Certification Question