A security architect is implementing controls to protect against training data poisoning attacks on a machine learning pipeline in Azure. The attacker model assumes that adversaries could inject malicious records into the data lake used for training. Which combination of controls provides the most comprehensive defense?

B is correct because a comprehensive defense against training data poisoning requires multiple layers: data provenance tracking (knowing where data came from), immutable storage (preventing modification of approved training data), integrity validation (detecting unauthorized changes via checksums before training), and distribution monitoring (detecting poisoning attempts that shift class distributions or insert adversarial patterns). D is incorrect because while dataset versioning and approved dataset policies help, they do not prevent poisoning of the approved source data or detect statistical anomalies. A is incorrect because Defender for Storage detects known malicious file signatures but not subtle data poisoning; logging statistics alone does not detect poisoning. C is incorrect because network controls and MFA prevent unauthorized access but do not address compromised authorized users or supply chain poisoning through legitimate data sources.