A product manager is concerned about the unintentional sharing of the company's intellectual property through employees' use of social media. Which of the following would BEST mitigate this risk?

A virtual desktop environment isolates the user's desktop from local hardware but does not block a user within that environment from browsing to social media sites and uploading content.

Network segmentation separates network zones to limit lateral movement and contain breaches, but it does not restrict which external websites users within a segment can access.

A web application firewall protects web applications from inbound attacks such as injection and cross-site scripting; it is not designed to filter or block employees' outbound access to social media.

A web content filter inspects and controls outbound HTTP/HTTPS traffic, allowing administrators to block or restrict access to social media platforms by category or URL. By preventing employees from reaching those sites on corporate networks, it stops accidental or intentional posting of intellectual property before data can be shared externally. This is a policy-enforcement mechanism applied at the network layer, which directly addresses the identified risk.