Which of the following refers to programs running in an isolated space to run untested code and prevents the code from making permanent changes to the OS kernel and other data on the host machine?

Input validation checks and sanitizes data supplied by users or external sources to prevent injection attacks but does not isolate code execution from the host OS.

Application hardening reduces an application's attack surface by removing unnecessary features and applying security configurations but does not create an isolated execution environment.

Code signing verifies that code came from a trusted author and has not been modified but does not restrict what the code can do at runtime.

Application sandboxing creates a walled-off execution environment where untested or untrusted code can run without having write access to the OS kernel, registry, file system, or other sensitive host resources. Any changes made inside the sandbox are contained and discarded when the sandbox session ends. This is the precise definition of sandboxing and directly matches the description in the question.