220-1101 Question 352
Single answerSandboxA technician receives an email attachment from an unknown sender that a user insists is required for a business project. The file appears suspicious, but the technician wants to observe its behavior without putting the company network or operating system at risk. Which action is the BEST way to proceed?
- A
Open the attachment on the user's workstation, but disconnect the PC from Wi-Fi first
- B
Run the attachment inside a sandboxed environment designed to isolate the file from the host system
- C
Copy the attachment to a shared network drive so multiple technicians can review it
- D
Temporarily disable antivirus software so the file can run without interference
Show answer and explanation
Correct answer: B
Explanation
The best answer is to run the file in a sandboxed environment. In A+ Core 1 security-related troubleshooting and best-practice scenarios, a sandbox is used to safely test or observe untrusted applications and files by isolating them from the production operating system. This supports the practical goal of analyzing suspicious behavior without exposing the user's workstation or the broader environment to unnecessary risk. Disconnecting from the network alone does not prevent local damage, and disabling antivirus is unsafe. Similarly, copying the file to a shared drive expands exposure rather than containing it. This aligns with common endpoint security best practices and vendor guidance that suspicious files should be analyzed in controlled, isolated environments rather than on production systems.
- A. Incorrect.
This is incorrect. Disconnecting from Wi-Fi may reduce network exposure, but the suspicious file could still damage the local operating system, corrupt files, or attempt persistence on the workstation. Simply taking the PC offline is not the same as isolating execution.
- B. Correct.
This is correct. A sandbox is intended to execute untrusted code in an isolated environment so the technician can observe behavior while limiting impact to the host operating system and production environment. This is a standard safe-handling approach for suspicious files.
- C. Incorrect.
This is incorrect. Placing a suspicious file on a shared network location increases risk by making it accessible to other users and systems. Shared storage is not an isolation method and could contribute to broader exposure.
- D. Incorrect.
This is incorrect. Disabling antivirus reduces protection and makes the system more vulnerable. It does not provide isolation and is the opposite of recommended security practice when handling potentially malicious attachments.