The correct option is GitHub Apps provide fine grained permissions and can request only the scopes they need.

GitHub Apps are installed on specific organizations or users and on selected repositories. During installation you can choose exactly which repositories the app may access and you can grant read or write permissions for distinct resource types such as issues or pull requests. The app then uses short lived installation tokens that include only the granted repositories and permissions, which enforces least privilege.

By contrast, OAuth apps act on behalf of a user and receive a user token that carries broad scopes which map to high level capabilities. The token inherits the user’s repository access within those scopes and the app cannot independently request narrowly tailored permissions for individual resource types. This is why the GitHub App model is more fine grained for repository and organization data.

Only verified organizations can publish GitHub Apps to GitHub Marketplace is incorrect because verification status is not the distinguishing factor for how access and permissions are granted. Verification is a marketplace trust attribute and does not define the permission model.

OAuth apps are required if you plan to charge for an app on GitHub Marketplace is incorrect because pricing and billing are not what separates the access models. Charging is independent of whether you use a GitHub App or an OAuth app and does not determine the permission granularity.

OAuth apps let you define repository level permissions that are more granular than GitHub Apps is incorrect because OAuth relies on broad user scopes and inherited access, while GitHub Apps offer the more granular per permission and per repository model.

Full AWS Practitioner Certification Question