Correct answer is C. you can find the explanation here: https://docs.vmware.com/en/VMware-Horizon/2203/horizon-cloud-pod-architecture/GUID-4CFD6907-AA23-42EA-B00C-39EC34819277.html

Access Groups are specifically designed for controlling entitlements. By associating specific Connection Servers with an Access Group, you can ensure that only those servers participate in a Global Entitlement. Access Groups allow fine-grained control over which servers are included or excluded from entitlements. When you create a Global Entitlement, you can specify the Access Group(s) that define the set of eligible servers.

Tags first then AGs..

Answer C: The Connection Server restrictions feature uses tag matching to determine whether a Connection Server instance can access a particular global entitlement. https://docs.vmware.com/en/VMware-Horizon/2203/horizon-cloud-pod-architecture/GUID-4CFD6907-AA23-42EA-B00C-39EC34819277.html

Answer D: With the Connection Server restrictions feature, you assign one or more tags to a Connection Server instance. Then, when you configure a global entitlement, you specify the tags of the Connection Server instances that you want to have access to the global entitlement. https://docs.vmware.com/en/VMware-Horizon-7/7.10/horizon-cloud-pod-architecture/GUID-4CFD6907-AA23-42EA-B00C-39EC34819277.html

c tags

You can configure tag restrictions (Connection Server restrictions) from the Global Entitlement wizard.