Which of the following will mitigate the risk of users who have access to an instance modifying the system configurations?

Whole-disk encryption protects data confidentiality at rest but does not prevent an authenticated user with instance access from modifying system configurations.

Deploying OS patches addresses known software vulnerabilities but does not restrict or govern what configuration changes an authorized user can make.

Anti-malware solutions detect and block malicious software but do not control the actions of legitimate users who already have access to the instance.

MAC is a non-discretionary access control model where a central authority defines and enforces access policies, removing the ability of individual users to alter system configurations at will. Unlike discretionary models, users cannot override or change permissions themselves. This directly mitigates the risk of insiders tampering with instance configurations.