A security architect is implementing controls to protect against training data poisoning attacks on a machine learning pipeline in Azure. The attacker model assumes that adversaries could inject malicious records into the data lake used for training. Which combination of controls provides the most comprehensive defense?

The correct combination is data provenance tracking with Microsoft Purview, immutable storage on the training data lake, checksum-based integrity validation before training jobs, and monitoring for statistical distribution anomalies. This is comprehensive because it establishes data origin, prevents modification of approved training data, detects unauthorized changes before training begins, and identifies poisoning attempts that shift class distributions or insert adversarial patterns. The option using Azure Defender for Storage to detect malicious file uploads and logging training data statistics is insufficient because Defender detects known malicious file signatures but not subtle data poisoning, and logging statistics alone does not detect poisoning. The option using Azure Firewall and MFA is insufficient because network controls and MFA prevent unauthorized access but do not address compromised authorized users or supply chain poisoning through legitimate data sources. The option using Azure Policy approved datasets and Azure ML dataset versioning is insufficient because versioning and approved dataset policies help, but they do not prevent poisoning of the approved source data or detect statistical anomalies.