In supervisory control and data acquisition (SCADA) systems, which of the following controls can be used to reduce device exposure to malware?

Disabling all command line interfaces may limit some attack vectors but does not prevent malware from executing through other means such as network-delivered payloads or compromised application logic.

Disallowing untested code in the execution space of a SCADA device implements an application whitelisting or execution control policy, ensuring only verified, trusted code can run on the device. This directly reduces malware exposure because malicious code cannot execute even if it is introduced to the system. This is a recommended ICS/SCADA hardening practice aligned with NIST and ICS-CERT guidelines for critical infrastructure protection.

Prohibiting unsecure scripting languages is a partial measure that addresses only one category of potential malware delivery and does not cover all forms of malicious code that could run on a SCADA device.

Disabling TCP/UDP port 138 (NetBIOS Datagram Service) reduces network attack surface for Windows-based systems but does not directly control or prevent malware from executing within the SCADA device's execution environment.