What is a sandbox in malware analysis?

• A. A public web service that analyzes samples
• B. A backup environment in the cloud
• C. A virtual machine used to clone disks
• D. A controlled, isolated environment used to safely execute suspicious software

Answer: (D)

A sandbox is a safe, isolated space where you can run malware to see what it does without risking the real system. It provides containment so the sample can’t affect the host, and it offers monitoring to observe actions like file changes, registry edits, process activity, and network traffic. This setup is designed to be repeatable and controllable, often using virtualization or containers, with restricted network access and tools to log everything that happens. That combination—safe execution plus thorough observation—is what makes a sandbox the right description for malware analysis. The other options don’t fit because they describe services or environments focused on analysis, backup, or disk cloning, not the dedicated, isolated execution space used to study suspicious software.