Which of the following will best ensure a workstation is protected against attacks over unused ports?

An Intrusion Detection System (IDS) monitors network traffic for suspicious activity and alerts, but it does not actively block traffic on ports like a firewall does.

Configuring a firewall is the most effective way to protect a workstation from attacks over unused network ports. A firewall allows administrators to explicitly block incoming and outgoing traffic on specific ports, thereby preventing unauthorized access attempts and exploitation of services that might be listening on those ports.

Antivirus software primarily protects against malicious software files and exploits, but it does not inherently block network connections on unused ports.

Disabling USB ports protects against physical attacks or data exfiltration via USB devices, not against network attacks over unused network ports.