nerdexam
EC-Council

312-50V12 · Question #218

In the process of setting up a lab for malware analysis, a cybersecurity analyst is tasked to establish a secure environment using a sheep dip computer. The analyst must prepare the testbed while…

The correct answer is B. Connecting the system to the production network during the malware analysis. To maintain a secure malware analysis environment, analysts must prevent any potential threat from escaping the testbed and compromising the production network. Connecting the system to the production network during malware analysis directly violates this critical security…

Submitted by cyberguy42· Mar 4, 2026System Hacking Phases and Attack Techniques

Question

In the process of setting up a lab for malware analysis, a cybersecurity analyst is tasked to establish a secure environment using a sheep dip computer. The analyst must prepare the testbed while adhering to best practices. Which of the following steps should the analyst avoid when configuring the environment?

Options

  • AInstalling malware analysis tools on the guest OS
  • BConnecting the system to the production network during the malware analysis
  • CSimulating Internet services using tools such as INetSim
  • DInstalling multiple guest operating systems on the virtual machine(s)

How the community answered

(38 responses)
  • A
    11% (4)
  • B
    71% (27)
  • C
    16% (6)
  • D
    3% (1)

Why each option

To maintain a secure malware analysis environment, analysts must prevent any potential threat from escaping the testbed and compromising the production network. Connecting the system to the production network during malware analysis directly violates this critical security principle.

AInstalling malware analysis tools on the guest OS

Installing malware analysis tools on the guest OS is a necessary step to perform the actual analysis within the isolated environment.

BConnecting the system to the production network during the malware analysisCorrect

Connecting a system actively analyzing malware to a production network poses a severe security risk, as the malware could escape the testbed environment and infect other systems on the network, leading to widespread compromise and data loss. Best practices dictate strict network isolation for malware analysis labs to contain potential threats.

CSimulating Internet services using tools such as INetSim

Simulating Internet services using tools like INetSim is a best practice to trick malware into thinking it has external connectivity, allowing its behavior to be observed without actually connecting to the real Internet, thereby maintaining containment.

DInstalling multiple guest operating systems on the virtual machine(s)

Installing multiple guest operating systems allows for comprehensive testing of malware across different platforms and versions, which is a common and often crucial aspect of thorough analysis.

Concept tested: Secure Malware Lab Network Isolation

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/network-best-practices

Topics

#malware analysis#sandbox environment#sheep dip#network isolation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice