What best describes malware sandboxing?

• A. Running a piece of malware in a contained environment and closely monitoring exactly what the software does.
• B. A process of scanning a system for malware in production.
• C. Blocking all outbound traffic from a host.
• D. Decrypting encrypted malware samples.

Answer: (A)

Malware sandboxing is about executing potentially harmful software in a contained, isolated environment to observe exactly what the program does without risking other systems. This approach lets you watch its runtime behavior—file and registry changes, process and network activity, and API calls—so you can understand its actions, payloads, and potential indicators of compromise in a safe setting.

The described option captures this idea directly: running the malware in a contained environment and closely monitoring its behavior. It’s the method that enables dynamic analysis and detonation while keeping the host and network protected.

The other ideas do not fit because they focus on different security activities. Scanning a system in production looks for signs of malware but doesn’t isolate or reveal how the malware behaves when it runs. Blocking all outbound traffic is a network defense measure, not a way to observe malware behavior. Decrypting encrypted malware samples is a step in analysis, often static or reverse engineering, but it doesn’t involve executing the malware in a sandbox to study its real-time actions.