Which of the following can best protect against an employee inadvertently installing malware on a company system?

An application allow list (or whitelist) is the best protection because it only permits approved applications to run on a system. This directly prevents an employee from installing and executing unauthorized software, including malware, even inadvertently. A host-based firewall controls network traffic but doesn't prevent local software installation. System isolation might contain malware if it's already present, but it doesn't prevent the initial installation. Least privilege restricts user permissions, which can help, but a user with even basic installation rights could still install malicious software if not explicitly blocked by an allow list.