A security administrator wants to harden macOS endpoints by preventing unsigned applications from running. Which macOS security feature enforces this policy?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Gatekeeper is macOS's application control feature that verifies developer signatures and Apple notarization before allowing applications to run, preventing unsigned or unnotarized applications from executing by default. A is wrong because FileVault provides full-disk encryption at rest; it does not control which applications can run.
Full explanation below image
Full Explanation
B is correct because Gatekeeper is macOS's application control feature that verifies developer signatures and Apple notarization before allowing applications to run, preventing unsigned or unnotarized applications from executing by default. A is wrong because FileVault provides full-disk encryption at rest; it does not control which applications can run. C is wrong because SIP protects system directories and critical system files from modification by any process, including root, but does not control user-installed application execution. D is wrong because Time Machine performs backups and has no role in controlling application execution.