A team of firewall administrators have access to a `master password list' containing service account passwords. Which of the following BEST protects the master password list?

Encrypting the file itself binds the protection directly to the sensitive content regardless of where the file resides or is copied. Even if the host system, disk, or USB device is accessed by an unauthorized party, the encrypted file remains unreadable without the correct decryption key, providing granular protection for the specific high-value asset.

Hashing the passwords within the list would make individual passwords non-recoverable for their intended use as service account credentials, rendering the master password list non-functional.

USB encryption only protects the file if it is stored on that specific encrypted USB drive and provides no protection when the file is copied to or accessed from a different storage location.

Full disk encryption protects all data on a volume from physical theft but does not protect the file from any user or process that has authenticated access to the running operating system.