Activity Policy (MCAS): Monitors and alerts on specific user actions such as uploading files, downloads, or logins to cloud apps. Perfect for detecting "upload to third-party storage".
Sensitivity label: Used for classifying and protecting content, not generating alerts.
File policy (MCAS): Inspects and governs files already stored in sanctioned apps, not upload activity.
Insider risk policy: Focuses on risky behavior like data exfiltration or security violations, not direct activity alerts in cloud apps.
answer: A. an activity policy
Reference: Defender for Cloud Apps activity policies