The IT department needs to prevent users from installing untested applications. Which of the following would provide the BEST solution?

Job rotation is an administrative control focused on reducing the risk of fraud and detecting unauthorized activities by rotating employee duties, not a technical control for preventing software installation.

Least privilege ensures that users are granted only the minimum necessary permissions to perform their job functions. By removing administrative rights from standard users, they are technically prevented from installing most applications, thereby addressing the requirement to stop the installation of untested software.

Account lockout is a security mechanism designed to prevent brute-force attacks by disabling an account after a specified number of failed login attempts, unrelated to software installation control.

Antivirus software is designed to detect and prevent malicious software, but it does not prevent users with sufficient privileges from installing legitimate but unapproved or untested applications.