Tracks program activity and detects malicious programs.

• A. Exclusions
• B. Advanced Protection Settings
• C. Linux Operating Mode
• D. Third-Party Security Services

Answer: (B)

Behavior-based protection watches what a program does at run time and looks for suspicious actions that indicate malware, rather than just scanning for known signatures. This dynamic monitoring detects malicious programs by observing activities like unusual process creation, attempts to modify critical files, or outbound connections to malicious hosts, and then blocks or alerts on those behaviors. Advanced Protection Settings is the area that configures these runtime safeguards, which is why it’s the best match for the description. Exclusions disable scanning for certain items, not the monitoring of behavior; Linux Operating Mode relates to the platform, and Third-Party Security Services are external integrations rather than the internal behavior-tracking feature.