A system administrator is concerned with employees connecting removable storage to the server to copy sensitive data. Which of the following solutions addresses this concern?

Disabling write access only prevents data from being written to the removable device but does not stop an employee from attaching the device and reading sensitive data off the server.

Wake-on-LAN (WOL) is a feature that allows a powered-off system to be turned on remotely over a network and has no relationship to removable storage security.

The Trusted Platform Module (TPM) is a hardware chip used for cryptographic operations and platform integrity verification, and disabling it has no effect on USB or physical port access.

Disabling physical ports - such as USB, eSATA, and Thunderbolt - at the BIOS/UEFI level or through group policy prevents any removable storage device from being physically connected to the server. This directly addresses the threat vector of unauthorized data copying via removable media by eliminating the means of attachment. It is the most targeted control because it prevents both read and write operations on any connected device.