A VDI provider suspects users are installing prohibited software on the instances. Which of the following must be implemented to prevent the issue?

Log monitoring can detect that prohibited software was installed but does not prevent the installation from occurring in the first place.

Patch management keeps software up to date to remediate known vulnerabilities, but it does not restrict users from installing unauthorized applications.

Vulnerability scanning identifies security weaknesses in existing software configurations, but it does not enforce controls that block software installation by users.

System hardening in a VDI context involves applying least-privilege principles, disabling software installation rights for standard users, and locking down the OS via group policy or configuration management. This proactively blocks the unwanted behavior at the system level rather than detecting it after the fact. Controls such as application whitelisting and restricted user account privileges are core hardening techniques that enforce what software can run or be installed.