The correct option is A time based immutability policy on the container.

A time based immutability policy on the container enforces a retention period at the container level and prevents blobs from being modified or deleted for the configured time. You can set the policy to 12 months and lock it so that any new blobs added to the container remain immutable for that retention window.

A stored access policy for SAS tokens is used to manage and revoke SAS tokens and to control delegated access windows and permissions but it does not make blobs immutable or prevent deletion for a set retention period.

Access tier only affects storage performance and cost by classifying blobs as hot cool or archive and it does not provide any mechanism to lock blobs against modification or deletion.

Access control and role assignments (IAM) control who has permissions to perform actions but they do not enforce a time based retention that prevents changes or deletions regardless of identity and they cannot replace an immutability policy.

Full AWS Practitioner Certification Question