Pull based deployments run an in cluster agent that fetches desired state from a Git repository and applies changes locally is the correct option.

With the pull based deployments run an in cluster agent that fetches desired state from a Git repository and applies changes locally an agent such as Flux or Argo CD runs inside the cluster and continuously reconciles the cluster against the Git desired state. The agent performs the apply operations locally so external CI systems do not need direct access to the cluster and you do not have to distribute long lived cluster credentials from a central pipeline to every cluster.

Push based deployments require an external CI pipeline to connect to the cluster and push updates which may require storing cluster credentials externally is incorrect for this question because it focuses on an implementation detail rather than the concise distinguishing characteristic. While push pipelines often do connect and push changes, the key difference is where the reconciler runs and which side initiates the change.

Pull based approaches always avoid exposing credentials to any external system so they are intrinsically more secure is wrong because pull approaches reduce the need to distribute credentials but they do not automatically eliminate credential exposure. The in cluster agent still needs appropriate permissions and you must secure Git access and any secrets used by the agent to keep the system secure.

Cloud Build is incorrect because it names a specific CI product and does not describe the conceptual difference between push and pull deployment models.

Full AWS Practitioner Certification Question