The correct option is Executive leadership has formally approved and authorized the incident response plan.

Formal approval by executive leadership shows that the incident response plan is not just a technical document but a governance instrument that supports commercial goals and leadership priorities. Executive authorization demonstrates that the plan has the necessary decision authority, resources, and visibility to be executed in ways that protect business objectives and meet stakeholder and regulatory expectations.

Access to the plan is limited to a small dedicated incident response group is incorrect because restricting access alone does not prove alignment with leadership priorities. Limiting visibility can hinder leadership engagement and prevent the plan from reflecting business needs and escalation paths.

The plan is maintained by the operations team and undergoes an annual technical review is incorrect because operational maintenance and periodic technical review are necessary but not sufficient. Those activities do not demonstrate executive buy in or that the plan addresses commercial risk decisions and priorities.

The document contains detailed step-by-step procedures for eradicating malware and disinfecting systems is incorrect because detailed technical procedures are useful for responders but they do not show that the plan aligns with business goals or has leadership authorization. Alignment requires governance, defined business objectives, and executive sponsorship as well as technical guidance.

Full AWS Practitioner Certification Question