Personal access token (PAT) is the correct authentication method to register a self hosted Linux build agent when the server and the agent machine are not in the same trusted domain.

A PAT is a user created token that you use instead of integrated Windows authentication. It can authenticate across domain boundaries and it is supplied during the agent configuration so the agent can register with the DevOps Server and join an agent pool. Create the PAT with the appropriate scopes so it can register and manage agents and then provide it when you run the agent setup script.

Alternate credentials are not correct because they are deprecated for Azure DevOps and they rely on basic username and password authentication which is less secure and often disabled. They are not the recommended method for registering self hosted agents across domains.

SSH key pair is not correct because SSH keys are used to authenticate Git or SSH sessions to machines. They are not the mechanism used by the agent configuration process to authenticate and register an agent with Azure DevOps Server.

Client certificate is not correct because client certificates are not the standard or documented method for registering self hosted build agents. Certificates might be used in custom network setups but they are not the expected or supported authentication method for typical agent registration.

Full AWS Practitioner Certification Question