A manager requests remote access to a server after hours and on weekends to check data. The manager insists on using the server. Before granting the access, which of the following is the MOST…

Removing Internet access during off hours is impractical because it prevents the manager from performing the very remote data checks that were requested.

Keeping antivirus updated and scanning daily is a good practice but is a compensating control - it is less effective than eliminating the underlying vulnerabilities through patching.

Patching closes known vulnerabilities in the OS and installed software that could be exploited if the manager visits a malicious site or unknowingly downloads malware. Without patches, even well-configured antivirus and browsing policies leave the server exposed to publicly documented exploits; patching is the foundational security control that must be in place before granting any remote access.

Educating the manager on safe browsing is a useful long-term measure but does not technically protect the server and does not address existing unpatched vulnerabilities.