Prevents execution of malware and unknown programs.

• A. Third-Party Security Services
• B. Exclusions
• C. Anti-Exploit Protection
• D. Lock Mode

Answer: (D)

Lock Mode is about controlling what can run on the endpoint. It enforces application allowlisting, meaning only programs you explicitly approve are allowed to execute. By blocking anything not on that list, it directly prevents malware and unknown or untrusted applications from launching, which is exactly how you stop execution of harmful software at the source.

Other options don’t provide this execution-control enforcement. Third-Party Security Services are external protections you might integrate with, but they don’t inherently stop unknown programs from running on the client. Exclusions simply skip protection for certain files or paths and don’t block new or untrusted programs by default. Anti-Exploit Protection mitigates techniques attackers use to exploit software vulnerabilities, but it doesn’t stop the initial execution of unknown programs.