Option B is correct because it configures an aggregated sink at the organization level in Cloud Logging, which automatically captures logs from all projects without per-project setup. This minimizes complexity and prevents log loss from misconfiguration (e.g., missing sinks for new projects). The logs are exported to Cloud Storage with a seven-year retention policy and Bucket Lock, which enforces immutability and prevents deletion or policy changes due to human error. This approach uses managed services (Cloud Logging and Cloud Storage) and aligns with compliance requirements for highly regulated domains. Options A and C fail because BigQuery lacks immutable retention features like Bucket Lock. Option D uses compliant storage but has project-level sinks, which increase the risk of log capture loss due to decentralized configuration.