The correct option is GitHub issues a scoped installation token with repository read permission that automatically expires after 60 minutes.

This mechanism relies on a GitHub App that issues a token with repository read permission that is limited to exactly what is needed. The token is short lived which reduces risk and it is issued automatically by GitHub to the workflow so no user must sign in. This satisfies least privilege while allowing self hosted runners to download actions from private and internal repositories in the organization.

GitHub generates a personal access token with repository read scope that remains valid for 60 minutes is incorrect because personal access tokens are user scoped and are not automatically minted per workflow for fetching actions. They generally require manual management and do not align with automated least privilege for each action download.

GitHub asks users to authenticate with their GitHub credentials whenever an action download occurs is incorrect because GitHub Actions is noninteractive and does not prompt users during a run. Tokens are generated automatically so no user sign in is needed.

GitHub grants the runner direct repository access for the full length of the workflow run is incorrect because GitHub does not grant broad repository access to the runner. Instead GitHub provides a narrowly scoped and time limited token for downloading only what is required.

Full AWS Practitioner Certification Question