Sandbox for Testing Suspicious Software
A security team requires an isolated environment that mirrors the production environment to test the behavior of suspicious software. Which of the following meets these requirements?
Community Insight
The question tests virtualization and containment concepts; the trap is picking VDI or a Type 1 hypervisor because they are 'virtual,' when only a sandbox is explicitly designed for safely detonating untrusted code.
This CompTIA A+ 220-1201 question asks which technology provides an isolated environment mirroring production for analyzing suspicious software. The correct answer is a sandbox, the purpose-built containment mechanism for safely executing and observing malware behavior without risking live systems.
Learners most often choose A (VDI), reasoning that a virtual desktop 'mirrors production.' VDI delivers hosted desktops to users for normal work—it is a delivery model, not a security containment tool for executing untrusted software.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A sandbox (D) is a deliberately isolated environment that can be configured to mirror the production environment—same OS build, patches, and applications—so suspicious software behaves as it would in the wild while being fully contained. Network access, file system, and registry changes are trapped inside the sandbox, allowing the security team to detonate and observe malware with no impact on production. Because the sandbox is disposable, any changes are discarded after analysis, which is exactly the requirement described.Why the Other Options Are Wrong
VDI (A) hosts virtual desktops that end users log into for day-to-day work; it centralizes desktop delivery rather than isolating untrusted code for behavioral analysis. Containers (B) share the host OS kernel and provide process-level isolation that is weaker than a full system image, so sophisticated malware can attempt container escapes or behave differently than on production. A Type 1 hypervisor (C) is a bare-metal virtualization platform (e.g., ESXi, Hyper-V) that runs VMs efficiently, but 'hypervisor' describes the layer that hosts VMs, not the security-testing purpose; a sandbox is the technique built on top of such virtualization for containment testing.Community Comment Notes
A single community voter answered D, reasoning that "Suspicious software goes into an isolated testing playground where it can't hurt production." That matches the standard A+ definition of a sandbox and aligns with this analysis—though a lone vote is not proof, the reasoning itself is technically sound.Exam Strategy
Watch for intent-based keywords such as 'test,' 'analyze,' 'suspicious,' or 'untrusted software'—these point to a sandbox rather than a general virtualization platform. When both VDI and sandbox appear, remember VDI is a user-facing desktop delivery model while a sandbox is a security analysis tool.
Frequently Asked Questions
Why is VDI not the right choice for testing suspicious software?
VDI is a desktop delivery model that hosts virtual desktops for normal user activity. It is not designed to contain and observe untrusted code, so using it for malware testing would put user-facing infrastructure at risk.
How does a sandbox differ from a Type 1 hypervisor?
A Type 1 hypervisor is the bare-metal platform that runs virtual machines. A sandbox is a security technique—often built on virtualization—that isolates untrusted code, monitors its behavior, and discards all changes afterward.
Related Analysis
Practice All 220-1201 Questions
Access 105 questions with complete answers and detailed explanations.
View Full 220-1201 Practice Test →