Mitigating New Ransomware with Sandboxing Analysis

CS0-003 By islever Editorial Last updated

Given a scenario, use appropriate tools or techniques to determine malicious activity

Short answer

C Deploy sandboxing to isolate and analyze the new ransomware's behavior, generating intelligence to mitigate its effects after antivirus fails.

Question

Which of following would best mitigate the effects of a new ransomware attack that was not properly stopped by the company antivirus?
  1. Install a firewall.
  2. Implement vulnerability management.
  3. Deploy sandboxing. Correct Answer
  4. Update the application blocklist.

Key Takeaways

The exam tests the distinction between signature-based defenses (which fail against new threats) and behavioral isolation techniques like sandboxing (which detect unknown malware).

This page explains why deploying sandboxing is the correct strategy for mitigating new ransomware attacks that bypass antivirus protection, focusing on behavioral analysis.

Common mistake: Candidates often choose D (Update application blocklist) because they assume blocking the binary will stop it. However, since the ransomware is 'new,' its signature is unknown, making proactive analysis via sandboxing necessary before effective blocking is possible.

Expert Analysis

The question asks for the best mitigation for a new ransomware attack that has bypassed antivirus. The key constraint is "new," implying the malware lacks known signatures or behavior patterns in existing security controls.

A firewall (A) manages network traffic but does not analyze file content or execution behavior to stop malware delivery or execution inside the perimeter.

Vulnerability management (B) addresses unpatched software flaws. While patching prevents exploitation of vulnerabilities, it is a preventive measure for future attacks, not an immediate mitigation for an active infection by a novel payload.

Updating an application blocklist (D) requires knowing the specific malicious binary or process name. Since the ransomware is "new," its hash and signature are likely unknown, making reactive blocking difficult without prior analysis.

Sandboxing (C) involves executing suspicious files in an isolated environment to observe behavior. This allows security teams to detect malicious activity (such as encryption attempts) that evades signature-based AV. By analyzing the behavior, indicators of compromise (IoCs) can be generated to update detection rules and blocklists. In the context of CompTIA Security+ CS0-003, sandboxing is the recognized technique for handling unknown threats by revealing their behavior when static defenses fail.

Exam Strategy

When you see keywords like 'new', 'unknown', or 'novel' threat, think about tools that provide visibility into behavior rather than just matching known signatures. Sandbox solutions are designed to execute and monitor suspicious code safely, allowing you to identify IoCs for unknown malware. Always distinguish between preventive measures (like patching) and detective/mitigative actions for active, unknown incidents.

Frequently Asked Questions

Why isn't updating the blocklist the best first step?

Because the ransomware is 'new,' its specific file hashes or process names are likely unknown. You cannot block what you do not yet know exists. Sandboxing helps discover these attributes.

Does sandboxing stop the current attack immediately?

Not directly. It provides the intelligence needed to update detection rules and blocklists to stop the spread and mitigate further damage from similar variants.

More CS0-003 FAQ →

Discussion 29 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 29

  1. FT000 👍 14 Answered C
    I would go with C too as sandboxing is the only 'mitigating control' from the given options. The rest look to me as 'preventive controls'.
  2. TurboMor 👍 8 Answered D
    Updating the application blocklist can immediately block the ransomware binaries on the rest of systems, making it the best option to mitigate the effects of a materialized ransomware attack.
  3. captaintoadyo 👍 5
    Sandboxing involves isolating potentially harmful files or programs in a secure environment to analyze their behavior without risking damage to the main system. In the context of the scenario provided, where a ransomware attack has already breached the company's defenses, implementing sandboxing may help prevent future attacks by better understanding how malware behaves. However, in the immediate aftermath of an attack, addressing vulnerabilities through vulnerability management (option B) would likely have a more immediate impact on mitigating the effects and preventing similar incidents in the future
  4. Dub3 👍 5 Answered C
    While options like installing a firewall (A), implementing vulnerability management (B), and updating the application blocklist (D) are important security measures, they may not directly address the immediate threat posed by the ransomware attack. Sandboxing provides a proactive defense mechanism specifically designed to detect and mitigate the effects of malware, including ransomware, by analyzing its behavior in a controlled environment.
  5. johnabayot 👍 5 Answered B
    B. Implement vulnerability management. This is because vulnerability management is a process of identifying, assessing, and remediating security weaknesses in systems and applications that could be exploited by malicious actors1. By implementing vulnerability management, an organization can reduce the attack surface and prevent ransomware from spreading or encrypting more data.
Show 24 more comments
  1. JAlexander35 👍 5
    What is sandboxing mitigating if the breach has already occured?
  2. crackman123 👍 4 Answered D
    pdating the application blocklist directly addresses and contains the active ransomware, preventing its execution and reducing its impact.
  3. Omo_Mushin 👍 3
    The best option to mitigate the effects of a new ransomware attack that was not properly stopped by the company's antivirus would be: C. Deploy sandboxing. Sandboxing allows you to run potentially malicious files or programs in an isolated environment where they cannot affect the rest of the system. This way, even if ransomware manages to get past the antivirus, its ability to cause harm would be limited to the sandboxed environment.
  4. TurboMor 👍 3
    Thank you. I was starting to believe I was alone on this one. Completely agree with this answer.
  5. iliecomptia 👍 2 Answered C
    From Study Guide page 195: Sandboxing for Malware Analysis The nature of modern malware means that signature-based tools are less likely to block execution automatically. Manual analysis of malware can provide intelligence that identifies wider IoCs, which can inform the development of custom signatures, IDS rules, and behavior-based rulesets for EDR solutions. Malware analysis must take place in a controlled environment to mitigate intrusion and data breach risks during the analysis process. The begining of the paragraph describes what happens in this question, and it is also mentioned at the end that sandboxing is used for mitigation.
  6. TurboMor 👍 2
    So... if you have an active ransomware attack in your organization, you are going to prefer starting the process of vulnerability management to attempt to prevent other systems from getting encrypted, rather than updating the application blocklist to immediately block the encryption binary? I would definitely update the blocklist first and then think about assessing and remediating vulnerabilities.
  7. StayInUrLane 👍 2 Answered D
    Updating the blocklist helps contain the spread of the ransomware and prevent further execution across systems. If the ransomware wasn't caught initially, ensuring that the binary or associated processes are blocked from running again is crucial. This is a mitigation step you can take after an infection has begun to limit further damage.
  8. JuanPires 👍 2 Answered C
    Questão mal formulada... Como atualizar lista de bloqueios, se não sabe. O tempo verbal deixa confuso se é para resolver a questão ou para o futuro...
  9. f90ecff 👍 2 Answered D
    How would sandboxing mitigate the damage of an active threat that the AV missed? Updating the blocklist seems the most logical solution to me.
  10. Popeyes_Chicken 👍 2
    Misunderstood the question. Proactive mitigation > Active spread. It's definitely C.
  11. Perc 👍 1 Answered B
    B. Implement vulnerability management actually is the best fit when viewed through a broader, real-world lens. Ransomware often exploits known weaknesses like unpatched software, misconfigurations, or open services. A strong, continuous vulnerability management process helps identify and remediate these weak points, reducing exposure and limiting damage—even after an attack slips through antivirus. While sandboxing helps analyze unknown threats, and blocklists work post-signature, vulnerability management addresses root causes and hardens the environment to prevent repeat infections.
  12. Popeyes_Chicken 👍 1 Answered D
    If a ransomware attack has already made it past the company antivirus. Implementing vulnerability management during a ransomware attack or installing a firewall doesn't seem to be the best option. Sandboxing might stop some lateral movement but doesn't guarantee it will mitigate the programs ability to run on other machines. Finding the ransomware program and adding it to an application block list ensures the application can't run / move laterally. Which will mitigate an active attack, instead of hoping a sandbox will stop it. Which it won't.
  13. Serac 👍 1 Answered D
    I’m thinking in term of prioritising isolation/containment first. Blocking the malware from running on other still clean systems would limit the damage. But I could argue that running a sandbox to better understand the malware to block it better is also reasonable. But that cost more time, so I’m going with D. Feeling almost 50/50 between them.
  14. Berro_b 👍 1 Answered C
    Traditional antivirus may miss new or unknown ransomware because it doesn't have a signature for the threat. Sandboxing allows suspicious files to execute in an isolated environment so their behavior can be analyzed without exposing production systems.
  15. Karl2011 👍 1 Answered D
    Sandboxing is for preventing delivery to host or to investigate what the impact may be. Since the ransomware is PRESENT, sandboxing is pointless. To MITIGATE the EFFECTS (Not mitigate the attack) we must block the app
  16. hashed_pony 👍 1
    This is one of those questions where all the answers seem not good enough. All of these measures are preventative when we're looking for corrective measures when the problem is already there.
  17. Perc 👍 1
    Sandboxing is primarily preventive and works best before malware executes. If the ransomware has already infiltrated and begun encrypting files, sandboxing won’t help.
  18. cy_analyst 👍 1 Answered B
    So actually this question is rhetorical and wants to know what the company should have done to prevent a future event of a ransomware attack.
  19. f90ecff 👍 1 Answered D
    If it's already on the system and has bypassed the AV, putting it on the application blocklist would prevent the system from executing it.
  20. Kakster 👍 1 Answered D
    Sandboxing won't stop already identified ransomware in real time. Good for detecting new malware though.
  21. Fuzm4n 👍 1 Answered D
    It doesn't say we know which asset is infected/affected. How would we know what to sandbox?
  22. facadex 👍 1
    blast radius. It's essentially the only one that 'would' do anything at this point.
  23. Nbake56 👍 1
    It it's a new ransomware, would it already be on a block list?
  24. Odogwu3024 👍 1
    I believe sandbox is strictly for testing

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Identifying Network Routing Anomalies Using ASN Lookups

S-grade

Next Step After Applying a Patch: Validation vs. Testing

S-grade

Missing Data from Network Vulnerability Scans

S-grade

Best Method to Preserve System Hard Drive Data for Litigation

S-grade

← Back to CS0-003 Study Guide