During a review of the email security solution, a security analyst collects the following information: Which of the following is the best way to improve the email security solution on the email…

Enabling allow lists (whitelisting) can reduce unwanted email but is prone to configuration errors and does not protect against malicious content from legitimate but compromised senders.

Configuring signature-based detection is a foundational security measure but is reactive and ineffective against novel, polymorphic malware or zero-day exploits without known signatures.

Implementing a HIDS (Host-based Intrusion Detection System) monitors individual endpoints, which is valuable for host-level security, but it does not improve the *email gateway's* ability to stop threats *before* they reach the endpoint.

Deploying sandboxing on an email gateway offers a robust improvement by executing suspicious email attachments and embedded links in an isolated, secure environment. This allows for dynamic analysis of their behavior to detect and block zero-day exploits and polymorphic malware that signature-based detection would miss, thus providing proactive protection against advanced threats.