A security administrator is hardening a TrustedSolaris server that processes sensitive data. The data owner has established the following security requirements: The data is for internal consumption…

SELinux provides mandatory access controls, but TrustedSolaris already includes native trusted extensions with built-in MAC capabilities, making SELinux largely redundant in this environment.

DLP focuses on preventing data exfiltration across network or endpoint boundaries but does not address the requirement to prevent local privileged user access to data or protect kernel integrity.

A HIDS monitors host activity and generates alerts on unauthorized file or data access attempts, including those made by privileged users such as the systems administrator, helping enforce the requirement that the administrator not have access to processed data.

A host-based firewall controls inbound and outbound network traffic but does not restrict a local systems administrator from accessing data files directly on the host or protect the kernel image.

Measured boot verifies the integrity of each component of the boot process, including the kernel image, by comparing cryptographic measurements against known-good reference values, directly satisfying the kernel integrity requirement.

Data encryption protects sensitive data at rest so that even if the systems administrator or an external party gains file system access, the actual data content remains unreadable without the appropriate decryption keys, addressing both the confidentiality and access restriction requirements.

Watermarking embeds tracking information into data for attribution and audit purposes but does not prevent unauthorized access to or distribution of the sensitive data itself.