This is because event types are added to events as a field named eventtype, and you can use this field as a
search term to find events that match a specific event type. For example, eventtype=successful_purchases
returns all events that have been categorized as successful purchases by the event type definition. The other
options are incorrect because they either use a different field name (tag), a different syntax (Event Type:: or
event type-), or have a typo (success ful_purchases). You can learn more about how to use event types in
searches from the Splunk documentation1.

Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/FXSelectMethodstep

Explanation
This search string is not valid: index=web status=50* | chart count over host,status2. This search string uses an invalid syntax for the chart command. The chart command requires one field after the over clause and optionally one field after the by clause. However, this search string has two fields after the over clause separated by a comma. This will cause a syntax error and prevent the search from running. Therefore, option A is correct, while options B and C are incorrect because they are valid search strings that use the chart command correctly.

Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Transaction