Which action does System Integrity Protection restrict?

System Integrity Protection (SIP) is a macOS security technology that limits what even the root user can modify or control in protected parts of the operating system. Apple specifically documents that SIP helps prevent software from selecting a startup disk, which makes option C the correct choice. SIP does not block ordinary user activities such as downloading files from external storage, installing approved App Store software, or saving documents outside the user’s home folder. Its purpose is to protect critical system locations and security-sensitive operations from unauthorized modification, including actions performed by processes running with elevated privileges. This protection reduces the ability of malicious software to alter essential macOS components or redirect startup behavior. Therefore, permitting software to select a startup disk is the action restricted by SIP.

================