A security team wants to see what unknown email attachments actually do when opened, such as files they write or connections they attempt, without risking any production endpoint. Which mitigation should the team apply?
Select an answer to reveal the explanation.
Short Explanation
A sandbox is a blast chamber for files: you set the attachment off in a sealed room and watch what it tries to do. You're after behavior, and the files are unknown, so signatures aren't going to cut it. Nothing escapes to your real endpoints.
Full Explanation
Sandboxing runs a suspicious file in an isolated, instrumented environment that mimics a real endpoint, then records its behavior: processes it spawns, files and registry keys it writes, and network connections it attempts. Because the environment is contained and disposable, malicious actions cannot reach production systems, and the observed behavior can drive a verdict even for malware that has never been seen before. Signature-based antivirus compares files against known malware patterns or hashes, which is efficient for known threats but cannot classify unknown files by behavior, and it does not show the team what an attachment does when opened. Sender Policy Framework checks whether the sending server is authorized for the domain in the envelope sender; it helps detect spoofing but says nothing about the attachment's content or actions. A honeyfile is a decoy document that triggers an alert when accessed, useful for detecting intruders browsing file shares, but it does not analyze inbound attachments at all. Exam caveat: some malware detects sandboxes and delays or suppresses its behavior, so sandbox verdicts are combined with other controls rather than trusted alone. Operational check: route a benign test file and a known test sample through the sandbox, confirm both produce behavior reports, and confirm attachments that receive a malicious verdict are quarantined before delivery.