A recent incident revealed a log entry was modified after its original creation. Which of the following technologies would BEST ensure end user systems are able to defend against future incidents?

An offline archival server stores logs in a network-isolated or air-gapped environment, making it impossible for an attacker with access to the production environment to reach and modify archived log entries. Because the server has no live network connectivity, post-incident tampering is effectively eliminated. This directly addresses the scenario where a log entry was modified after its original creation.

MFA strengthens authentication for service access but does not prevent a user or attacker who has already authenticated from modifying log entries.

Blockchain provides cryptographic immutability but is not a standard end-user system log-protection control and does not address the offline storage requirement for tamper resistance.

A behavioral HIDS detects suspicious activity on endpoints but does not inherently prevent log tampering once an attacker has gained the necessary privileges.