200-201 Question 217
Single answerA security analyst is investigating a suspicious email attachment. To analyze the behavior of the attachment without risking harm to the production network, the analyst decides to use a sandbox. Which of the following best describes why a sandbox is suitable for this task?
- A
It isolates the file in a controlled environment to observe its behavior.
- B
It permanently deletes the file after scanning to prevent infection.
- C
It encrypts the file to render it harmless for analysis.
- D
It sends the file to a threat intelligence database for immediate classification.
Show answer and explanation
Correct answer: A
Explanation
A sandbox is a key cybersecurity tool used to safely execute and analyze potentially malicious files in a controlled environment. This allows analysts to observe the file's behavior without risking harm to the production network or sensitive data. Unlike scanning or classification tools, a sandbox focuses on dynamic behavioral analysis, which is crucial for detecting sophisticated threats.
- A. Correct.
Correct. A sandbox creates a controlled, isolated environment where potentially malicious files can be executed to observe their behavior without affecting the production network.
- B. Incorrect.
Incorrect. A sandbox does not delete files; it is designed to analyze them in a safe environment.
- C. Incorrect.
Incorrect. Encrypting a file does not provide insight into its behavior or potential malicious activity.
- D. Incorrect.
Incorrect. While threat intelligence databases are helpful for classification, they do not provide behavioral analysis in a controlled environment like a sandbox does.