At a hospital, a suspicious email attachment is opened inside a disposable virtual machine so the analyst can watch the files it creates and the connections it makes. Which term names that work?
Select an answer to reveal the explanation.
Short Explanation
You learn what a strange package does by opening it in a sealed room. Running the hospital attachment in a disposable VM and watching files and connections is malware analysis. Reading the code, modeling the design, and scanning for missing patches are other jobs.
Full Explanation
The action in the scenario is execution under observation, not a design review and not a reading of the instructions. Malware analysis that runs the attachment in a disposable VM and watches files and connections is detonation analysis of this file. Reverse engineering that reads the attachment code itself instead of watching the file run in a VM inspects the program without relying on this run. Threat modeling, a design exercise about how an attacker might abuse hospital systems, reasons about a design and does not open this attachment. Vulnerability scanning of hospital hosts, a search for missing patches rather than this file, looks for weaknesses on systems and does not detonate the sample. Watching files and connections during the run is the behavior the disposable machine was stood up to capture. Exam caveat: a quiet run can mean the sample refused to execute in the virtual machine; that result is still detonation analysis, not a reason to rename the work as a design review. Operational check: record the file hash, the processes the sample started, and the connections it opened from the disposable virtual machine.