A cloud architect wants to minimize the risk of having systems administrators in an IaaS compute instance perform application code changes. The development group should be the only group allowed to mo

Removing write permissions from the application service account would break the application's own ability to write files, not restrict sysadmins from making changes.

Restricting file write permissions to the development group directly enforces the intended access control policy through standard Discretionary Access Control (DAC) on the filesystem. All other accounts, including systems administrators, have no write access by default because they are not members of the group granted that permission.

Adding fileshare access for the sysadmins group expands their permissions rather than restricts them, which is the opposite of the stated objective.

Denying all development user accounts would prevent developers from making any code changes, directly contradicting the requirement that developers be the only group allowed to modify files.