The correct answer is B. Universal Containers has internal Account OWD set to Public Read/Write, which lets internal users broadly access Account records. However, Experience Cloud / customer community users can have a separate external sharing model. Salesforce documentation explains that External Organization-Wide Defaults provide separate default access for external authenticated users so companies can better secure data for community users.

Setting the Account external OWD to Private prevents customer community users from seeing all company Account records by default.

Why others are incorrect:

A record types do not control record visibility.

C an owner-based sharing rule would grant more access, not restrict default access.

D permission sets grant object/field permissions; they do not replace OWD record-sharing control.

===========