The SELinux and AppArmor security frameworks include enforcement rules that attempt to prevent which of the following attacks?

Lateral movement is primarily addressed by network segmentation and credential controls, not by OS-level process confinement frameworks.

SELinux and AppArmor enforce kernel-level mandatory access control by labeling processes and resources and restricting what each process can access, even if it is compromised. This containment model is specifically designed to prevent a process from breaking out of its confined execution context - the definition of a sandbox escape - by denying unauthorized system calls, file access, and inter-process communication.

CSRF is a web application attack mitigated by anti-forgery tokens and same-site cookie policies, operating at the HTTP layer, not the OS MAC layer.

XSS is a client-side web vulnerability mitigated by output encoding and Content Security Policy headers, which are outside the scope of kernel-enforced MAC frameworks.