Servers are updated according to the organization patch management process and receive current security fixes is correct because it describes an active, documented control that shows the organization is maintaining its security posture and managing risks.

Applying patch management and timely security fixes demonstrates ongoing attention to vulnerabilities and provides tangible evidence for auditors that due diligence is being practiced. Regular updates reduce exposure to known threats and show that the organization follows its governance and compliance processes.

Data custodians have not documented the enterprise data protection framework is incorrect because missing documentation of a data protection framework is a governance gap. That omission indicates a failure to perform required oversight and it is a breach of due diligence.

System administrator omits the required three week vacation schedule is incorrect because mandatory, enforced vacations are a control to detect fraud and ensure segregation of duties. Not following that schedule is a breakdown of controls and thus a violation of due diligence.

The security policy is no longer current or aligned with standards is incorrect because an outdated policy means governance and compliance activities are not being maintained. A current and aligned security policy is a basic expectation of due diligence and its absence is a breach.

Full AWS Practitioner Certification Question