A server administrator is trying to prevent database administrators from installing programs or making administrative changes to the server. Which of the following should the administrator do to…

Enabling a policy that requires user credentials before administrative changes can proceed - such as UAC or a similar privilege escalation control - means that database administrators without the appropriate admin credentials are actively blocked from making those changes. This is a preventive control, not a detective one, because it stops the action before it occurs. It enforces separation between standard user roles and administrative roles at the policy level.

Sending alerts when changes are attempted is a detective control that notifies someone after the fact, but it does not prevent the changes from being made.

Enabling logging for database administrators records their activity for later review but places no restriction on whether they can actually perform administrative actions.

Privileged access auditing captures a record of administrative actions already taken, which supports accountability and forensics but does not block unauthorized changes from occurring.