The correct option is --check.

--check runs the runners built in network connectivity test so you can confirm that a Linux self hosted runner in a private subnet can reach the required GitHub endpoints before scheduling more jobs. This parameter exercises outbound connectivity and validates access to key services such as the GitHub API and the Actions service, and it reports clear pass or fail results without starting a job. It is the intended and documented way to verify networking from the runner host.

--diag is not a supported runner parameter. While diagnostics and debug logs exist, this specific flag is not recognized by the runner executable for network validation.

--verify-connection is not a valid runner option and it does not correspond to any built in connectivity test, so it will not perform the required checks.

--validate-network is not an option provided by the runner, therefore it cannot be used to test reachability to GitHub endpoints.

Full AWS Practitioner Certification Question