Blocks unknown programs from untrusted sources.

• A. Lock Mode
• B. Exclusions
• C. Hardening Mode
• D. Linux Operating Mode

Answer: (C)

Restricting what software can run on the endpoint, especially from sources you don’t trust, is a key defense against malware. Hardening Mode is the setting that enforces strict execution controls so unknown or unsigned programs from untrusted sources are blocked from running by default. This reduces the attack surface by preventing unverified software from executing, which helps stop malware and exploits that rely on running from untrusted sources. It often works by requiring trusted signatures, applying allowlists, and tightening script and executable execution rules, so only vetted software is permitted.

Lock Mode focuses on preventing changes to the system or security settings, not on blocking unknown programs. Exclusions are about exempting specific files or processes from security checks, which doesn’t address blocking unknown software by default. Linux Operating Mode isn’t a relevant option for this kind of execution-control behavior.