The correct option is They call the cloud providers' public APIs to collect telemetry user activity file metadata and security settings without installing agents.

They call the cloud providers' public APIs to collect telemetry user activity file metadata and security settings without installing agents is correct because Defender for Cloud Apps uses API connectors to integrate with supported SaaS providers and read activity and configuration information. The connectors typically authenticate using OAuth or service accounts and pull logs, file metadata, and security settings from the providers' public APIs so there is no need to deploy endpoint agents to gather that telemetry.

They make direct connections to the cloud providers' backend servers to extract information is incorrect because the solution uses documented public APIs and authorized connectors rather than undisclosed backend server access. The integration relies on official API endpoints and permissions that the cloud provider exposes to third party apps.

They require installing agent software on every user device to gather activity data is incorrect because Defender for Cloud Apps collects most telemetry via API connectors and through log ingestion from services. Agents on endpoints are not required for the API based visibility scenario described in the correct option.

They operate as an inline cloud access security broker that intercepts user sessions to enforce policies is incorrect because that describes an inline or proxy based CASB mode. Defender for Cloud Apps can support session control through proxy or reverse proxy integrations for real time enforcement but the standard app connectors themselves are API based and do not intercept live user sessions.

Full AWS Practitioner Certification Question