thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Malware Sandbox

An isolated, instrumented environment where suspicious files or URLs are executed safely to observe behavior.

Definition

Sandboxes such as Cuckoo/CAPE, ANY.RUN, Joe Sandbox and Palo Alto WildFire run samples in virtual machines and produce reports on behavior, network indicators and verdicts. Email gateways and firewalls use cloud sandboxes to detonate attachments before delivery. Sandboxes can be evaded by environment-aware malware.

Example

A firewall forwards an unknown PDF to WildFire, which returns a malicious verdict and generates a signature.

Exam tip

Sandboxing is the answer when the question asks how to safely determine what an unknown file does.

Related terms