The correct answer is D. Create an Apex Trigger on the Account object.

The requirement is conditional: allow Account deletion generally, but block deletion when the Account has open Opportunities. A validation rule is not the correct tool because validation rules evaluate record data during save operations, while this requirement is specifically about preventing a delete operation.

An Apex before delete trigger can query related open Opportunities and call addError() on the Account record to stop the delete. Salesforce Apex documentation confirms that triggers can run before or after delete events, and trigger errors can prevent DML operations from completing.

A is incorrect because removing Delete permission blocks all Account deletion.

B is incorrect because removing the Delete button is not security and does not stop deletion through other channels.

C is incorrect because validation rules are not the right mechanism to block conditional deletes.

===========