Which of the following types of jailbreaking allows user-level access but does not allow iboot-level access?

A bootrom exploit targets the read-only boot ROM, the very first code executed on the device, providing the deepest possible access including iBoot-level and surviving restores.

An iBoot exploit specifically targets the iBoot bootloader stage, which by definition grants iBoot-level access - the opposite of what the question describes.

A sandbox exploit escapes an application's sandbox container but does not represent a distinct jailbreaking category that grants system-wide user-level access without iBoot access.

A userland exploit leverages vulnerabilities in user-space processes or applications (such as a browser or media parser) to gain elevated privileges within the OS, but it cannot compromise the iBoot bootloader or bootrom. This means the exploit does not survive a full device restore and cannot run unsigned code at boot time, distinguishing it from lower-level exploits.