Either of the following two options revert back to a clean initial state in every reboot. Which is the most secure against tampering by remote-controlled malware trying to permanently modify the filing system? grub2 boot from an ISO image fsprotect
Depends on where the OSs are I'd think. Closed session CD, write protected flash drive, hard drive etc.