The correct options are Restrict deployments to specific branches such as main and release, Require approval from designated reviewers before a deployment runs, and Block self approval when the deployment requester authored the change.

Limiting deployments to selected branches ensures production is only updated from vetted sources. This branch restriction aligns with governance needs because it prevents unintended or experimental branches from triggering a release to the protected environment.

Requiring approvals from designated reviewers is an environment protection that enforces separation of duties. The workflow pauses at the deployment gate until specific users or teams approve, which ensures oversight and accountability for production changes.

Blocking self approval prevents the person who initiated the deployment from approving it. This closes a common gap where a requester could otherwise approve their own release and it reinforces the separation of duties policy.

Enforce that all required status checks on the default branch pass before deployment is not an environment deployment protection. It is a branch protection rule that governs merging changes rather than controlling who can deploy and when, so it does not meet the stated governance goals for environment deployments.

Full AWS Practitioner Certification Question