200-201 Question 216
Single answerA cybersecurity analyst is investigating a suspicious email attachment that might contain malware. They decide to use a sandbox to analyze the file. What is the primary benefit of using a sandbox in this situation?
- A
It provides a controlled environment to execute and observe malicious behavior without risking production systems.
- B
It guarantees that the file being analyzed is completely safe for use in the organization.
- C
It automatically removes malware from the file before it is delivered to the end-user.
- D
It provides real-time monitoring of network traffic originating from known malicious IP addresses.
Show answer and explanation
Correct answer: A
Explanation
A sandbox is a critical tool in cybersecurity for analyzing potentially malicious files or software in a safe, isolated environment. By executing the file in a controlled setting, analysts can observe its behavior and identify threats without endangering production systems or sensitive data.
- A. Correct.
This is correct because a sandbox provides an isolated, controlled environment where files can be executed and observed without risking harm to production systems.
- B. Incorrect.
This is incorrect because a sandbox does not guarantee that a file is safe; it only helps identify potentially malicious behavior.
- C. Incorrect.
This is incorrect because a sandbox does not clean malware from files; its purpose is analysis, not remediation.
- D. Incorrect.
This is incorrect because while some monitoring tools provide real-time network traffic analysis, this is not the primary function of a sandbox.