An email attachment from an external supplier is not blocked by signature-based AV, but the SOC wants to see whether it drops files, launches child processes, or contacts suspicious domains before delivery to users. Which control best fits?

Network IDS, because it passively monitors traffic for known threats.

An IDS can alert on patterns, but it does not safely execute the attachment to observe behavior.

DLP, because it prevents sensitive data from leaving the organization.

DLP focuses on data leakage and policy enforcement, not behavioral analysis of suspicious attachments.

NAC, because it controls whether a device can join the network.

NAC governs device access to network resources, but it does not inspect or detonate email attachments.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Sandboxing, because it detonates the file in an isolated environment. — Sandboxing is the best choice because it opens the file in an isolated environment and observes what it does in real time. That makes it especially useful when signature-based detection misses a new or modified attachment. Analysts can see whether the file creates processes, writes files, contacts external servers, or exhibits other malicious behavior before the message is released to users. Why others are wrong: An IDS only observes and alerts on traffic; it does not execute attachments. DLP focuses on protecting sensitive content from leaving the organization, which is a different problem. NAC controls device admission to the network and has no role in safely detonating email files.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.