An administrator is concerned about users accessing network shares outside of their job role. Which of the following would BEST prevent this?

Assigning share permissions based on group membership implements the principle of least privilege - users inherit only the access rights granted to their security group, which maps to their job role. This is a technical access control mechanism enforced by the operating system, not dependent on user behavior. It directly prevents unauthorized access rather than just detecting or discouraging it.

A written policy is an administrative control that relies on user compliance and does not technically enforce or block unauthorized access.

SNMP is a network monitoring protocol used to collect device statistics; it can detect access after the fact but cannot prevent unauthorized users from reaching shares.

Blocking all remote logins is overly broad and would disrupt legitimate remote access, while still leaving local network share access unrestricted.