SY0-701 Security Operations Practice Question
Exhibit
Email Security Gateway Queue Message ID: 77129 From: vendor.billing@example.net Subject: Updated invoice for Q4 Attachment: invoice_q4.xlsm Attachment Type: Macro-enabled spreadsheet Static Scan Result: No signature match Dynamic Analysis Status: pending Policy Action: hold for review
Based on the exhibit, which tool should the security team use to safely observe the attachment's behavior before delivery to users?
⚠ Common exam trap
Candidates often confuse sandboxing with DLP or SIEM, thinking that blocking data exfiltration or reviewing logs after delivery is sufficient, when the question specifically requires observing behavior before delivery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sandboxing, so the file can execute in a controlled environment before release.
Sandboxing allows the security team to execute the attachment in a controlled, isolated environment to observe its behavior (e.g., network connections, file modifications) without risking the production network. This is the correct approach because it safely detonates the file before delivery, enabling detection of malicious activity such as ransomware or trojans. Other tools like DLP, NAC, or SIEM do not provide the dynamic analysis needed to assess the attachment's runtime behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Sandboxing, so the file can execute in a controlled environment before release.
Why this is correct
Sandboxing is designed to detonate suspicious files safely and observe their behavior. Because the attachment is a macro-enabled spreadsheet and static scanning did not find a known signature, dynamic analysis is the right next step. This helps confirm whether the file tries to drop malware, contact an external server, or modify the system.
- ✗
DLP, so the gateway can block sensitive data from leaving the organization.
Why it's wrong here
Data Loss Prevention (DLP) systems inspect content in motion, at rest, or in use to enforce policy on sensitive data such as PII or PCI. Deploying DLP at the gateway would scan the email body and attachments for credit card numbers or classified content, but it cannot safely detonate a macro-enabled Excel file to observe malicious behavioral indicators like process injection or outbound command-and-control callbacks. It is a data governance control, not a malware dynamic analysis tool.
- ✗
NAC, so the sender's device can be checked before the message is accepted.
Why it's wrong here
Network Access Control (NAC) evaluates the security posture of endpoint devices—checking for up-to-date antivirus, patches, or compliance with quarantine policy—before granting them network connectivity. This pre-admission assessment applies to the sender's machine at the network layer, not to the content of an incoming SMTP message, and it would not reveal whether the attachment's macros attempt to execute PowerShell or write to autorun registry keys. NAC addresses device trust, not file-based threats.
- ✗
SIEM, so the team can store the attachment and review alerts later.
Why it's wrong here
A Security Information and Event Management (SIEM) platform aggregates logs and alerts from firewalls, EDR, and authentication systems to enable correlation and retrospective threat hunting. Copying the attachment into log storage would preserve the artifact for later IoC-based matching, but SIEM lacks the isolated runtime environment required to trigger the macro and analyze its actual execution flow—such as API calls to VirtualAlloc or DNS queries to suspicious domains. It is for event correlation, not static or dynamic file analysis.
Go deeper
Related to this question
Learn chapter
Log Monitoring and SIEM
Key term
NAC
Network Access Control (NAC) is a security technology that enforces policies to control which devices and users can connect to a network.
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.