The correct options are Add a CODEOWNERS file and Apply a branch protection rule to the primary branch.

A Add a CODEOWNERS file lets you designate teams or individuals as owners for paths in the repository and GitHub will automatically request reviews from those owners when matching files change. Configuring a CODEOWNERS file is how you assign the security team as required reviewers for the parts of the code they must approve.

Applying a Apply a branch protection rule to the primary branch enforces repository level policies such as requiring pull request reviews, blocking direct pushes, and requiring that status checks pass before a merge. A branch protection rule can require reviews from code owners so combining protection rules with a CODEOWNERS file ensures the security team must approve changes before the primary branch accepts them.

Google Cloud Build is a continuous integration and delivery service and it can run builds and tests, but it does not enforce GitHub repository merge policies or require specific team approvals in the repository settings.

Add a LICENSE file documents the legal terms for reuse of the code and it has no effect on review workflows or merge requirements.

Require signed commits enforces cryptographic signatures on commits to verify authorship, but it does not by itself force that a particular team approves pull requests before merging. Branch protection and code owner review settings are needed to require specific approvals.

Full AWS Practitioner Certification Question