The correct option is Enforce required reviews and successful status checks on protected branches before merging.

Branch protection rules allow maintainers to require approving pull request reviews and passing status checks before any change can be merged. This ensures that only validated and reviewed code reaches the main branch. These rules can also prevent force pushes and deletions and can restrict who can push which strengthens governance for regulated environments.

CODEOWNERS designates ownership and can automatically request reviewers which is helpful for accountability but it does not block merges on its own. Only a protection rule that requires reviews will enforce a gate.

Dependabot alerts provide security notifications for vulnerable dependencies and help teams remediate risk. They do not control merge behavior and they are not a branch protection mechanism.

Use a .gitignore file to stop tracking confidential files helps avoid adding certain files to future commits on developer machines but it does not enforce reviews or status checks and it does not protect against already committed secrets.

Full AWS Practitioner Certification Question