The correct option is Project administrators can add users to roles that are specific to their project.

A user with the Administer Project permission for a single project can manage role membership within that project and assign users to the project specific roles that exist for that project. They do not have broader system administrator powers and their authority is limited to project scoped role assignments.

The statement Project administrators can create new system permissions and assign them to project roles is incorrect. Creating or changing system wide permissions is a system administrator task and is not available to someone who only administers a single project.

The statement Project administrators can map project roles to system permissions is incorrect. Mapping roles to system level permissions is controlled at the system level and requires system administrator rights.

The statement Project administrators can define new project roles and grant them project permissions is incorrect. Defining new roles or altering role definitions is typically a higher level configuration activity and is not allowed for a user limited to Administer Project on one project.

The statement Project administrators can add users directly to system permission groups is incorrect. System permission groups are managed by system administrators and adding users to those groups requires system level privileges.

Full AWS Practitioner Certification Question