Sofia wants to prevent privilege escalation attacks via her organization's service accounts. Which of the following security practices is best suited to this?

The most important step in securing service accounts is to ensure that they have only the rights that are absolutely needed to accomplish the task they are designed for. Disabling interactive logins is important as well and would be the next best answer. Limiting when accounts can log in and using randomized or meaningless account names can both be helpful in some circumstances but are far less important.