The city mail gateway quarantined an unknown attachment on a permitting clerk's message. Which analysis tool should the SOC use to learn what the file does?
Select an answer to reveal the explanation.
Short Explanation
An unknown attachment is a locked box. A sandbox is the bomb-squad table where you open it safely and watch what it tries. DHCP leases and historian trends will not detonate the file.
Full Explanation
When the city mail gateway quarantines an unknown attachment on a permitting clerk's message, the SOC needs dynamic analysis of what the file does: a sandbox or malware-analysis detonation of the quarantined sample. Detonation reveals process behavior, network callbacks, dropped files, and persistence—answers that DHCP leases, historians, and backup catalogs cannot provide for malware capability questions.
DHCP lease history for the clerk's VLAN explains address assignment on the segment, not malware behavior inside the attachment. Wastewater historian analog trends measure process values for pumps and tanks, not attachment payloads. Elections file-server backup catalogs list backup sets and restore points, not detonated malware behaviors or C2 callbacks.
Exam caveat: unknown malicious file questions point to sandbox or detonation plus static analysis; infrastructure and OT logs are the wrong tools for what-does-the-file-do.
Operational check: submit the quarantined attachment to the approved civic sandbox, capture behaviors and indicators, feed hashes and domains into Enterprise Security threat intelligence, and hunt endpoints that may have received the same message before quarantine.