Which of the following is the BEST way to prevent dangerous SQL write statements from being executed on data?

Row-level security restricts which rows a user can see or access, but does not prevent write statements on the rows that are accessible.

Encryption protects data confidentiality in transit and at rest, but does not restrict the ability to execute write statements against the database.

Excluding access to specific tables or columns limits the scope of accessible data, but write statements can still be executed against the tables and columns that remain accessible.

A read-only data warehouse is configured to disallow INSERT, UPDATE, and DELETE operations at the database or connection level, meaning no SQL write statement can be executed regardless of user permissions or application vulnerabilities. This is an architectural control that eliminates the attack surface for destructive write operations entirely. Other controls reduce scope but do not prevent writes on the data they do allow access to.