A company that provides kiosk workstations wants to improve the workstations' security implementation. The company is concerned that attackers can take control of the workstations during the boot proc

Setting controls to allow only specific operating systems is a policy choice that does not inherently prevent malicious modules from loading during the boot process if the authorized OS is compromised or bypassed.

Removing any unused connection ports reduces physical attack vectors but does not address software-based attacks during the boot process itself.

Allowing only digitally signed modules to load, a core feature of Secure Boot, ensures that only trusted and verified software components can execute during the system's boot process. This directly prevents attackers from injecting or modifying boot components to take control and alter data flow before the operating system fully loads.

Creating bootloader passwords offers a basic security layer but can be bypassed by sophisticated attackers with physical access or by exploiting vulnerabilities in the boot process before the password prompt.