Add a GitHub Actions workflow that runs CodeQL in each repository is correct. You must add a workflow to each repository so that CodeQL analysis runs during the repository build and the scan picks up C# projects and their build artifacts.

CodeQL analysis is executed by the CodeQL Action workflows and those workflows build the code and run the CodeQL queries. Adding the repository workflow is the required activation step because the workflow controls when and how the analysis runs and it specifies the target language and build steps for C#.

Enable Dependabot alerts is incorrect because Dependabot alerts identify vulnerable dependencies and they do not run CodeQL queries or perform source code analysis.

Enable Dependabot security updates is incorrect because enabling automatic dependency updates helps remediate vulnerabilities but it does not activate CodeQL scanning or perform code query analysis.

Enable GitHub Advanced Security is incorrect by itself because the product provides access to CodeQL features in licensed repositories but you still need to add or enable the actual CodeQL workflow or configuration to run scans in each repository.

Full AWS Practitioner Certification Question