The correct answer is C because Cloud Asset Inventory can search resources across an organization and filter by asset type and creation time. The asset type iam.googleapis.com/ServiceAccountKey directly targets service account keys, which is exactly what must be audited. Using organization scope is important because the question says there are hundreds of service accounts across applications, likely distributed across projects. Cloud KMS keys are encryption keys, not service account keys, so option A searches the wrong resource type. Listing service accounts only identifies service accounts, not their individual keys or key ages. API keys are different credentials from service account keys, so option D also targets the wrong asset type. Cloud Asset Inventory is the most scalable audit method here.