The correct option is Direct jobs to matching self-hosted runners by selecting labels that describe their capabilities. This aligns with the need to ensure that jobs run only on machines with GPUs or a licensed security scanner.

In GitHub Actions you assign custom labels to self-hosted runners to describe their hardware and tools. A job then specifies the labels in the runs-on configuration and the scheduler will only place the job on a runner that has all of those labels. This reliably routes workloads to the right machines when you manage many runners with different capabilities.

Improve runner security by enforcing access controls with labels is not correct. Labels are selection metadata rather than an access control mechanism. Access is governed by runner groups and by where the runner is registered and by repository or organization policies.

Give workflow jobs descriptive names for easier monitoring is not correct. Job naming is handled by the name field in the workflow while labels are used to target runners based on capabilities.

Cloud Build is not part of GitHub Actions. It is a different service so it does not describe how custom labels are used for runner selection.

Full AWS Practitioner Certification Question