Top-down maps risks to strategic objectives while bottom-up compiles risks that may not tie to business priorities is correct.

The top-down method starts with the organizations strategic objectives and identifies risks that could prevent achieving those objectives. The bottom-up method starts with detailed operational and technical issues and then aggregates those findings into a risk view, which means it may produce items that do not clearly map back to business priorities.

The Security Command Center option is incorrect because it names a security product rather than describing how risk scenarios are built. It does not address the conceptual difference between top-down and bottom-up risk methods.

The Bottom-up focuses solely on operational and technical weaknesses rather than business aims option is incorrect because bottom-up work does not always occur in isolation. Bottom-up findings can be mapped to business impact and used to inform priorities even though the starting point is operational detail.

The Top-down prioritizes technical vulnerabilities and ignores business context option is incorrect because the top-down approach explicitly emphasizes business context and strategic objectives. It is centered on how risks affect goals rather than on ignoring business context.

Full AWS Practitioner Certification Question