This question is about the correct order of Workday security assignment for integrations. Workday clearly specifies the security structure:
"You assign the ISU to the Integration System Security Group (ISSG).
Then you assign the ISSG to the domain security policies."
This is because domain security policies apply to security groups, not directly to ISUs.
Correct Relationship Order:
* Create ISU
* Create/assign ISU to ISSG
* Assign ISSG to the domain security policies (Get/Put/View)
That aligns exactly to option C.
References:Admin#Guide#Authentication#and#Security.pdf - Concept: Integration Security in Workday (Security Groups # Domain Policies hierarchy)