220-1102 Question 670
Single answerSandbox testingA help desk technician receives an email attachment from a user who reports that the file is required for a vendor payment update, but the message was unexpected and the attachment is an executable. Company policy allows technicians to investigate suspicious files only in an isolated test environment before deciding whether to escalate. Which action should the technician take FIRST to follow best practices for sandbox testing while minimizing risk to the production network?
- A
Open the attachment on the user's workstation while disconnected from Wi-Fi to see whether it launches normally
- B
Upload or execute the file in an isolated sandbox environment designed for malware analysis and observe its behavior
- C
Move the file to a shared network folder so other technicians can test it from their own PCs
- D
Rename the file extension to .txt and open it in Notepad to confirm whether it is malicious
Show answer and explanation
Correct answer: B
Explanation
Sandbox testing is used to analyze suspicious files in an isolated environment so technicians can evaluate behavior without endangering production systems. In an A+ Core 2 context, the key concept is safe handling of potentially malicious software: isolate first, observe behavior, and then escalate or remediate based on findings. Running unknown executables on a live endpoint, even one that is temporarily disconnected, is not an acceptable substitute for isolation. Likewise, copying the file to shared storage expands risk rather than containing it. Security best practices from major vendors such as Microsoft and common incident-response guidance emphasize isolation, least exposure, and controlled analysis environments when handling suspicious attachments or executables.
- A. Incorrect.
This is incorrect because testing a suspicious executable on the user's workstation is unsafe even if the device is temporarily offline. Malware can still modify local files, create persistence, steal cached data, or attempt to spread once connectivity returns. Sandbox testing is intended specifically to avoid exposing production endpoints to untrusted code.
- B. Correct.
This is correct because a sandbox provides an isolated environment for safely detonating or analyzing suspicious files without risking the user's endpoint or the production network. Observing file, process, registry, and network behavior in a controlled environment is the appropriate first step before further remediation or escalation.
- C. Incorrect.
This is incorrect because placing a suspicious file on a shared network location increases exposure and could allow accidental execution by other users or systems. Best practice is to contain suspicious files, not distribute them across production resources.
- D. Incorrect.
This is incorrect because changing the extension does not reliably determine whether a file is safe. An executable can still be malicious regardless of its name, and simply viewing content in a text editor is not an appropriate validation method for executable malware analysis. This reflects a common misconception that file extensions alone define risk.