An organization implements application whitelisting on endpoints. Users report that legitimate business applications are being blocked. What is the MOST effective approach to managing exceptions while maintaining security?

A is correct because a formal exception process balances usability with security by ensuring each exception is reviewed, documented, and only granted for legitimate business needs. This maintains whitelist integrity while accommodating real requirements. B is wrong because disabling whitelisting for complaining users defeats the security control. C is wrong because blacklisting requires knowing all bad applications in advance and misses zero-day and novel malware. D is wrong because malware is frequently signed with stolen or fraudulently obtained code-signing certificates.