156-521 · Question #212
Threat Emulation performs which task?
The correct answer is C. Simulates file execution in a sandbox. Threat Emulation opens suspicious files inside an isolated virtual sandbox and observes their runtime behavior - simulating execution to catch zero-day malware before it reaches users, making C correct. Why the distractors are wrong: A (removes active code) describes Threat…
Question
Threat Emulation performs which task?
Options
- ARemoves active code from documents
- BUses DNS to classify URLs
- CSimulates file execution in a sandbox
- DExecutes IPS signatures on the gateway
How the community answered
(19 responses)- B5% (1)
- C95% (18)
Explanation
Threat Emulation opens suspicious files inside an isolated virtual sandbox and observes their runtime behavior - simulating execution to catch zero-day malware before it reaches users, making C correct.
Why the distractors are wrong:
- A (removes active code) describes Threat Extraction, a companion technology that sanitizes documents by stripping macros and embedded objects - it cleans files rather than analyzing them.
- B (DNS to classify URLs) describes URL Filtering, which categorizes web addresses using a DNS-based reputation database.
- D (IPS signatures on the gateway) describes the IPS (Intrusion Prevention System) blade, which matches network traffic against known exploit signatures - a pattern-matching approach, not sandboxed execution.
Memory tip: Think "Emulation = Execution in a box." Threat Emulation emulates what happens when a file runs, safely inside a sandbox. If you mix it up with Threat Extraction, remember: Extraction removes, Emulation executes.
Topics
Community Discussion
No community discussion yet for this question.