The correct option is Allow outbound HTTPS long polling from the runners to the required "GitHub" endpoints.

Self hosted runners initiate and maintain HTTPS connections to GitHub in order to register, receive job assignments, and report results. They use long polling over port 443 and do not require any inbound connections. This design allows you to keep all inbound access blocked on the private subnet while still enabling the runners to function normally as long as they can reach the necessary endpoints on the internet.

Open inbound firewall rules from "GitHub" to the runner hosts is incorrect because the service does not initiate inbound connections to your runners. Opening inbound access is unnecessary and it conflicts with the requirement to keep inbound blocked.

Enable Cloud NAT for internet egress from the private subnet is incorrect as the technology can provide a path to the internet but it is only one way to achieve egress. The essential requirement is that runners can reach GitHub over HTTPS. NAT can help but it is not the specific capability being asked for and it is not strictly required if another egress method exists.

Force all egress through an HTTP proxy before reaching "GitHub" is incorrect because a proxy is optional. Runners can connect directly when outbound HTTPS is allowed and a proxy is only needed in environments that mandate one.

Full AWS Practitioner Certification Question