Try a Security+ question.

Security Operations

Several users report the same suspicious attachment. A SOC analyst must learn what the file does when opened, including any network callbacks, without putting production systems at risk. Which technique should she use?

• ACopy the file into a honeyfile share that raises alerts on access
• BDetonate the file in an isolated sandbox and record its behavior
• CAdd the file's hash to the email gateway's block list at once
• DOpen the file on a patched workstation while capturing its traffic