SY0-701 Security Operations Practice Question
An email attachment from an external supplier is not blocked by signature-based AV, but the SOC wants to see whether it drops files, launches child processes, or contacts suspicious domains before delivery to users. Which control best fits?
⚠ Common exam trap
Many candidates confuse passive monitoring (IDS) with active behavioral analysis (sandboxing), assuming IDS can detect unknown threats by watching traffic, but IDS lacks the ability to execute and observe the file's runtime actions in an isolated environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sandboxing, because it detonates the file in an isolated environment.
Sandboxing is the correct control because it detonates the file in an isolated, virtualized environment to observe its runtime behavior, such as dropping files, spawning child processes, or making outbound connections to suspicious domains. This goes beyond signature-based AV by analyzing dynamic behavior rather than static file hashes or patterns. The SOC's goal is to assess the file's actions before delivery, which sandboxing directly addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network IDS, because it passively monitors traffic for known threats.
Why it's wrong here
A network IDS passively receives copies of traffic from a SPAN port or tap and matches packets against signatures, anomaly rules, and reputation feeds for known threats. Because it never opens or executes the attachment, fileless, polymorphic, or time-triggered malicious behavior is invisible to it until a signature exists. Its role is detection of traffic patterns, not dynamic analysis of untrusted files.
- ✓
Sandboxing, because it detonates the file in an isolated environment.
Why this is correct
Sandboxing detonates the suspicious attachment in a contained virtual machine or emulated operating system with instrumentation that records file drops, registry and process modifications, and outbound callbacks. By observing actual runtime behavior, it can reveal malicious intent even if no signature exists, while isolating any payload from production resources. It is therefore the correct control for inspecting a supplier attachment that an external email filter does not block.
- ✗
DLP, because it prevents sensitive data from leaving the organization.
Why it's wrong here
Data loss prevention tools inspect the content and context of outbound messages to identify sensitive information such as PII, protected health information, or proprietary data and block policy violations at the network, endpoint, or email gateway. DLP cannot execute an attachment, so it cannot evaluate the file's runtime behavior; a malware attachment with no sensitive content passes through unless a different security layer also examines it. Its focus is preventing data exfiltration, not analyzing executable behavior.
- ✗
NAC, because it controls whether a device can join the network.
Why it's wrong here
Network access control enforces trust based on device identity, endpoint posture, and authentication, typically through 802.1X or agent checks, before granting access to network resources. It neither receives email attachments nor detonates them; a compliant device can still deliver a malicious file unless additional controls inspect content. NAC is about who/what connects, while sandboxing is about what a file does when executed.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. The email security team receives a suspicious invoice attachment from a vendor. The attachment is not blocked by signature-based detection, but the team wants to observe its behavior in a safe environment before delivery to users. What tool best fits this requirement?
medium- ✓ A.Sandboxing the attachment in an isolated analysis environment
- B.Network access control for unmanaged devices
- C.A data loss prevention rule on outbound email
- D.An intrusion prevention system placed on the Wi-Fi network
Why A: A sandbox provides an isolated, controlled environment where the suspicious attachment can be executed and monitored for malicious behavior without risking the production network. This allows the security team to observe dynamic indicators such as file system changes, registry modifications, or outbound connections that signature-based detection might miss. The goal is to analyze the attachment's true intent before deciding whether to deliver it to users.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.