SY0-701 Question 270
Single answerSandboxingA security analyst receives a suspicious spreadsheet attachment from a vendor email account that may have been compromised. The organization wants to determine whether the file contains malicious macros, but it cannot risk executing the file on a user workstation or production server. Which of the following is the BEST action to take first?
- A
Open the spreadsheet on the analyst's workstation and monitor Task Manager for unusual activity
- B
Upload the file to a sandbox environment that can execute the attachment in isolation and observe its behavior
- C
Move the file to long-term cold storage so it cannot be accessed by users
- D
Block all spreadsheet attachments at the email gateway and assume the file is malicious
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use a sandbox to execute the suspicious attachment in isolation and observe its behavior. In Security+ terms, sandboxing is a protective control and analysis technique that allows potentially malicious code to run in a constrained environment separated from production systems. This is especially useful for suspicious email attachments, documents with embedded macros, and unknown executables. Real-world security operations commonly use sandboxing as part of malware analysis and email security workflows. Guidance from organizations such as CISA and NIST emphasizes analyzing suspicious files in controlled environments and avoiding direct execution on production endpoints. Sandboxing helps identify behaviors such as command-and-control traffic, process injection, persistence mechanisms, and file system changes while limiting impact to enterprise assets.
- A. Incorrect.
This is incorrect because opening a suspicious attachment on an analyst workstation exposes the endpoint to potential compromise. Even if the analyst watches for abnormal processes, malicious code may evade casual observation, execute quickly, or establish persistence before detection. A common misconception is that a trained analyst workstation is safe for direct testing, but best practice is to use isolated analysis environments for potentially malicious content.
- B. Correct.
This is correct because a sandbox provides an isolated environment where the suspicious spreadsheet can be detonated and monitored for malicious behavior such as macro execution, process spawning, registry changes, network callbacks, or file modifications. Sandboxing is specifically designed to reduce risk while allowing dynamic analysis of untrusted code or attachments.
- C. Incorrect.
This is incorrect because moving the file to cold storage may preserve evidence, but it does not help determine whether the attachment is malicious. This choice focuses on retention rather than analysis. Someone might choose it because preserving suspicious files can be important for forensics, but it is not the best first step when the immediate goal is to safely evaluate behavior.
- D. Incorrect.
This is incorrect because blocking spreadsheet attachments may be a possible broader control if there is an ongoing campaign, but it does not analyze this specific file. It also assumes malicious intent without verification. This option reflects a common operational mistake of jumping straight to a broad preventive control when the scenario asks for the best first action to safely investigate.