A penetration tester is able to move laterally throughout a domain with minimal roadblocks after compromising a single workstation. Which of the following mitigation strategies would be BEST to…

Randomizing local administrator credentials per machine directly addresses pass-the-hash reuse but is not among the three primary controls recommended for this broad lateral movement scenario.

Disabling remote logons for local administrators closes one specific lateral movement vector but does not address credential strength or data protection across all attack paths.

Requiring MFA for all logins means that even if an attacker harvests credentials from one workstation, they cannot authenticate to other systems without the second factor, directly blocking credential-reuse lateral movement across the domain.

Increasing minimum password complexity requirements raises the cost of brute-force and dictionary attacks against credential hashes extracted from the compromised host, slowing the attacker's ability to pivot to additional accounts.

Network access control adds port-level authentication but does not directly address the credential compromise and reuse that allowed the tester to move freely across hosts.

Enabling full-disk encryption on every workstation protects sensitive data and locally cached credentials stored at rest on disk, limiting what an attacker can extract and reuse from a physically or logically compromised machine.

Placing each host in its own VLAN is an extreme segmentation measure that would be operationally disruptive to normal domain operations and is not the most practical first recommendation.