The correct answer is Diffie-Hellman.

Diffie-Hellman is the canonical public key key agreement algorithm that allows two endpoints to derive a shared secret over an untrusted network without sending the secret itself. It is widely used as the key exchange component in protocols such as TLS and IPsec and it supports ephemeral modes that provide forward secrecy.

RSA is an asymmetric algorithm used for encryption and digital signatures and it can be used to transport keys in some protocols. It does not perform the same interactive key agreement process as Diffie-Hellman and it will not provide forward secrecy unless combined with ephemeral mechanisms.

SHA-256 is a cryptographic hash function and not an asymmetric algorithm. It produces message digests and cannot be used by itself to perform key agreement between two parties.

AES is a symmetric block cipher used for bulk encryption and it requires a shared key. It is not a method for two endpoints to agree on a secret, although the key AES uses can be established via a key agreement algorithm such as Diffie-Hellman.

Full AWS Practitioner Certification Question