The correct option is Ingest Defender telemetry via the Microsoft 365 Defender APIs.

This approach uses the official, programmatic interfaces that expose alerts, incidents, and telemetry in structured form so you can build dependable and scalable ingestion into a centralized logging platform. The APIs support filtering and incremental queries and they can be combined with notification mechanisms to reduce polling and to provide near real time delivery.

Using the APIs lets you authenticate with managed application credentials and follow Microsoft rate limits and best practices. This makes automated, repeatable ingestion easier to maintain than manual or ad hoc methods and it avoids reimplementing features that Microsoft already provides.

Enable periodic manual exports from Microsoft 365 Defender to the log platform is not ideal because manual exports are error prone and do not scale for continuous security analysis. They are slower and require ongoing human intervention or brittle scheduling.

Deploy a custom collector agent on the log server to fetch Defender data is also suboptimal because it duplicates functionality that the APIs provide and it forces you to manage authentication, rate limiting, retries, and updates on your own. An agent can work but it is not the most maintainable or scalable option.

Stream Defender alerts into Google Cloud Pub/Sub using a connectors pipeline is incorrect as stated because there is no native, direct Defender to Pub/Sub connector built into the product. You would still rely on the Defender APIs or intermediary services to export the data, so the best practice is to use the official APIs for ingestion and then forward into Pub/Sub if you need that transport.

Full AWS Practitioner Certification Question