Accounts with any verified email address from a nonpublic domain may be granted product access is the correct statement.

This statement is correct because NovaAccess is designed to grant product access based on the presence of a verified email from a nonpublic domain, so administrators can allow accounts that present such verified addresses to access the product without requiring every domain to be preapproved.

An organization domain must be approved before NovaAccess can be enabled is incorrect because domain approval is not necessarily a prerequisite for enabling or using NovaAccess when access can be granted to accounts with verified nonpublic email addresses.

Invitation links remain valid indefinitely while they are enabled is incorrect because invitation links are typically subject to expiration or can be revoked and are not guaranteed to remain valid indefinitely even if they are enabled.

The two methods to approve a domain are HTTPS validation and DNS records is incorrect because domain verification methods vary and commonly include different approaches such as DNS TXT records or file based HTTP verification rather than the exact pair stated.

Existing users can only invite people who share the same organization domain to join a product is incorrect because invitations can be extended to accounts with verified emails from other nonpublic domains when policies and settings permit it.

Full AWS Practitioner Certification Question