A database server for a financial application is scheduled for production deployment. Which of the following controls will BEST prevent tampering?

Service account removal reduces the attack surface by eliminating unnecessary privileged accounts, but it does not directly prevent tampering with data that legitimate accounts or application processes can still access and modify.

Data validation enforces rules on what data can be entered, modified, or processed by the database, directly preventing unauthorized or malformed data from corrupting or tampering with records. For a financial application, input validation controls such as type checking, range checks, and referential integrity constraints stop attackers from injecting malicious values or altering data in unauthorized ways. This is a proactive control that prevents tampering at the point of data entry rather than detecting it after the fact.

Logging and monitoring are detective controls that identify tampering after it has occurred, but they do not proactively prevent unauthorized data modification on the database server.

Data sanitization primarily addresses the removal of sensitive data (e.g., before decommissioning) or the neutralization of malicious input to prevent injection attacks, but it is not the best direct control against general data tampering in a production deployment context.