The correct option is Filtering by group membership.

Filtering by group membership lets Azure AD Connect synchronize only the members of one or more on premises security groups so you can build a pilot by adding the specific users to those groups. This approach is easy to manage because you can add or remove pilot users by updating group membership without changing the directory structure or editing many user attributes. It also reduces risk because only group members are targeted for synchronization.

Attribute based filtering is not the best choice here because it requires setting and maintaining specific attribute values on each user and it is more error prone for short term pilots. You can use attributes to filter but it requires more planning and changes to user accounts.

Domain based filtering is incorrect because it limits synchronization by verified domain or UPN suffix and it cannot target an arbitrary subset of users within the same domain. That makes it a poor fit when the pilot involves a mixed set of users across domains or within a single domain.

Organizational unit filtering is not ideal when you need a flexible pilot because it ties synchronization to the AD OU structure. Moving users between OUs or reorganizing AD can unintentionally change who is included in the pilot so groups are usually preferred for temporary or cross OU pilots.

Full AWS Practitioner Certification Question