Exam CS0-003 Topic 3 Question 618 Discussion
Actual exam question for CompTIA's CS0-003 exam
Question #: 618
Topic #: 3
Question #: 618
Topic #: 3
An employee received a phishing email that contained malware targeting the company. Which of the following is the best way for a security analyst to get more details about the malware and avoid disclosing information?
Suggested Answer: D Vote an answer
Comprehensive Detailed
To safely analyze malware while avoiding unintended disclosure of company information, it is best to use a local sandbox in a microsegmented environment. Here's why:
A . Upload the malware to the VirusTotal website
Risk: VirusTotal and similar services are public and may share uploaded files with other security vendors, potentially exposing proprietary or sensitive information.
B . Share the malware with the EDR provider
Limitation: While EDR providers may offer insight, sharing potentially sensitive malware samples externally still introduces risk of disclosure or data leaks.
C . Hire an external consultant to perform the analysis
Cost and Risk: Hiring an external consultant can be costly and may introduce risks related to third-party handling of sensitive data. Although it may provide insights, this is typically not the most efficient initial response.
D . Use a local sandbox in a microsegmented environment
A local sandbox provides a secure, isolated environment for malware analysis without exposing sensitive data outside the organization. Microsegmentation enhances security by further isolating the sandbox from the network, preventing lateral movement if the malware attempts to communicate externally.
Reference:
NIST SP 800-83: Guide to Malware Incident Prevention and Handling for Desktops and Laptops.
MITRE ATT&CK: Techniques and recommendations for malware analysis in isolated environments.
To safely analyze malware while avoiding unintended disclosure of company information, it is best to use a local sandbox in a microsegmented environment. Here's why:
A . Upload the malware to the VirusTotal website
Risk: VirusTotal and similar services are public and may share uploaded files with other security vendors, potentially exposing proprietary or sensitive information.
B . Share the malware with the EDR provider
Limitation: While EDR providers may offer insight, sharing potentially sensitive malware samples externally still introduces risk of disclosure or data leaks.
C . Hire an external consultant to perform the analysis
Cost and Risk: Hiring an external consultant can be costly and may introduce risks related to third-party handling of sensitive data. Although it may provide insights, this is typically not the most efficient initial response.
D . Use a local sandbox in a microsegmented environment
A local sandbox provides a secure, isolated environment for malware analysis without exposing sensitive data outside the organization. Microsegmentation enhances security by further isolating the sandbox from the network, preventing lateral movement if the malware attempts to communicate externally.
Reference:
NIST SP 800-83: Guide to Malware Incident Prevention and Handling for Desktops and Laptops.
MITRE ATT&CK: Techniques and recommendations for malware analysis in isolated environments.
by Haley at Dec 22, 2025, 06:26 PM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).