It was discovered that a service provider's administrator was accessing sensitive information without the approval of the customer in an Infrastructure as a Service (laaS) model. Which of the followin

Data encryption protects data confidentiality but does not prevent an authorized administrator (who might possess decryption keys or privileged access) from performing unauthorized actions.

An IPS might detect some malicious network activity, but it wouldn't prevent an administrator with legitimate system access credentials from misusing their authorized privileges.

Two-factor authentication protects against unauthorized access to accounts, but if the administrator *is* authorized to the system, 2FA won't prevent them from misusing that access.

Contractual requirements explicitly define the scope of access, responsibilities, and accountability for service providers, establishing a legal framework to prevent and address unauthorized actions by their personnel. These agreements can include clauses for auditing, penalties for breaches, and data handling protocols, providing a strong preventative measure.