SY0-701 Question 271
Single answerSandboxingA security analyst receives a suspicious email attachment that appears to be an invoice PDF. The company wants to determine whether the file is malicious without risking infection of employee workstations or production servers. Which of the following is the BEST action to take first?
- A
Open the attachment on the analyst's workstation while disconnected from the network
- B
Submit the attachment to a sandbox environment for controlled behavioral analysis
- C
Allow the email gateway to deliver the file and rely on endpoint antivirus alerts
- D
Copy the attachment to a production file server and monitor for unusual access patterns
Show answer and explanation
Correct answer: B
Explanation
The best first action is to submit the attachment to a sandbox environment. Sandboxing is a security control that isolates untrusted code or files so their behavior can be analyzed safely. In real-world operations, security teams use sandboxing to detonate suspicious attachments and URLs, observe indicators of compromise, and make containment decisions before exposing endpoints or servers. This aligns with common incident analysis and malware-handling best practices: do not execute suspicious content on production assets, and use isolated environments for detonation and behavioral analysis. Industry guidance from organizations such as NIST emphasizes containment, isolation, and controlled analysis during malware investigation and incident response.
- A. Incorrect.
This is incorrect because opening a suspicious attachment on the analyst's normal workstation still puts that system at risk, even if it is disconnected from the network. Malware can affect the local host, exploit vulnerabilities, alter files, or persist for later execution when connectivity returns. Disconnecting from the network does not provide the same isolation and containment as a sandbox.
- B. Correct.
This is correct because a sandbox is designed to execute suspicious code in an isolated, controlled environment so analysts can observe behavior such as process creation, file modification, registry changes, and network callbacks without exposing production assets. This is a standard and practical first step when investigating potentially malicious attachments.
- C. Incorrect.
This is incorrect because relying on endpoint antivirus after delivery is reactive and unnecessarily exposes end-user systems to risk. Antivirus may detect known malware signatures, but sophisticated or newly modified malware may evade detection. A sandbox provides safer pre-delivery or out-of-band analysis.
- D. Incorrect.
This is incorrect because placing a suspicious file on a production server violates basic containment principles and could expose shared infrastructure to compromise. Monitoring for unusual access patterns does not prevent execution or malicious behavior and is not an appropriate first action for suspicious malware analysis.