You are responsible for ensuring that all VM instances spun up in your project are compliant with your organization's security baseline. What is the best approach to automate this verification?

*Explanation:* The correct choice is C. Organization Policy with constraints. It allows you to proactively enforce constraints, ensuring only compliant VMs are created in your project. Option A is incorrect because it is a reactive measure triggered by VM creation. Option B is also incorrect as it only notifies post-creation. Option D makes it easier to create compliant VMs but does not enforce it proactively. Option E, Real-time Stream Analytics with Dataflow, is not suitable for this use case.