A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to the attackers…

The correct answer is A. Upload the binary to an air gapped sandbox for analysis. The best action that would allow the analyst to gather intelligence without disclosing information to the attackers is to upload the binary to an air gapped sandbox for analysis. An air gapped sandbox is an isolated environment that has no connection to any external network or…

Submitted by lucia.co· Mar 6, 2026Security operations

Question

A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to the attackers. Which of the following actions would allow the analyst to achieve the objective?

Options

AUpload the binary to an air gapped sandbox for analysis
BSend the binaries to the antivirus vendor
CExecute the binaries on an environment with internet connectivity
DQuery the file hashes using VirusTotal

How the community answered

(29 responses)

A
79% (23)
B
3% (1)
C
14% (4)
D
3% (1)

Explanation

The best action that would allow the analyst to gather intelligence without disclosing information to the attackers is to upload the binary to an air gapped sandbox for analysis. An air gapped sandbox is an isolated environment that has no connection to any external network or system. Uploading the binary to an air gapped sandbox can prevent any communication or interaction between the binary and the attackers, as well as any potential harm or infection to other systems or networks. An air gapped sandbox can also allow the analyst to safely analyze and observe the behavior, functionality, or characteristics of the binary.

Topics

#malware analysis#threat intelligence#sandboxing#air gap

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice