The correct option is Pin each action reference to a full commit SHA so the target cannot change.

This approach uses an immutable identifier for each action so the referenced code cannot be altered after you choose it. It ensures reproducible builds and lowers supply chain risk because any change requires a new commit which produces a different identifier that you must intentionally adopt.

Use branch names for versioning to avoid tag churn is wrong because branches move with new commits and can be force pushed or deleted which means the referenced code can change underneath you and your builds will drift.

Binary Authorization is wrong because it is a deployment control for container images in certain platforms and it does not pin what GitHub Actions executes inside a workflow.

Pin to an abbreviated commit SHA to keep the reference concise is wrong because shortened identifiers can be ambiguous as the repository grows and GitHub Actions expects the full forty character commit identifier for reliable pinning. This does not meet the reliability and security goals.

Full AWS Practitioner Certification Question