This is where declarative precision matters. Use B. Apex; C. AppExchange. A Lightning component must be exposed for the surface where it is used. A component built for one page type or action surface does not automatically become available everywhere in Lightning Experience.
The selected answer is stronger because it meets both the functional requirement and the maintainability requirement. In a Salesforce implementation, a solution that only works for one user, one page, or one data sample is not good enough. The correct feature has to behave consistently across the intended profiles, record types, apps, and devices that are part of the design.
The other choices would leave a gap in the implementation. A (Validation Rule) misses the mark because A validation rule blocks saves; it does not create records, route approvals, display components, or grant access.
D (Approval Process) is less defensible because An approval process is for formal sign-off, not for every automation, display, import, or security requirement. In a real org, the builder should include negative testing as well, proving that the rule does not fire or display outside the intended conditions.
For AppExchange components, the builder should verify the component target, activate the relevant Lightning page, and test the page in the same form factor used by the target users.
---