The correct answer is B because the Organization Policy Service provides a managed resource locations constraint for restricting where supported location-based resources can be created. Using the gcp.resourceLocations list constraint with an allowed_values entry is the cleanest and lowest-maintenance approach. The in:australia-locations value represents Google’s predefined location group for Australia locations, avoiding manual custom logic. A denied_values policy would block only specified locations and could accidentally allow other regions, which does not satisfy the strict regulatory requirement. Custom CEL policies add unnecessary complexity and are less appropriate when a built-in list constraint exists for this exact purpose. The requirement asks for minimal configuration, so using the predefined location group in allowed_values is the strongest fit.