A security engineer is hardening a fleet of production Linux VMs running a well-defined set of applications in a public cloud IaaS environment. The workloads are static — the same processes run continuously and no new software is expected to be installed at runtime. The team wants to prevent any unauthorized or unknown executable, script, or process from launching on these workloads, even if an attacker gains a foothold. Which workload security control best meets this requirement?