Which of the following is the best way to prevent malicious code from executing on a laptop based on attack signatures?

A host-based firewall controls network traffic to and from a laptop, blocking unauthorized access but not primarily preventing the execution of malicious code already present on the system based on signatures.

Antivirus software uses signature-based detection to identify known malicious code and heuristics to detect unknown threats, actively preventing their execution on a host system.

Patching fixes vulnerabilities in software, reducing the attack surface, but it doesn't directly prevent malicious code execution based on signatures in the same way antivirus software does for active threats.

A network-based firewall protects an entire network perimeter, blocking unauthorized traffic at a broader level, rather than preventing malicious code execution on an individual laptop based on its signatures.