CISA Question 362

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B2

  It’s not penetration testing because that only simulates known attack techniques - things already documented or expected, like SQL injection or weak password exploits. The question says “discovering unknown malicious attacks.” That means zero-day or previously unseen threats, the stuff a pen test won’t find because it’s not yet in the list of known exploits. Sandboxing runs suspicious code in an isolated environment to watch its behavior, so it can catch unknown malware and zero-day attacks before they’re even identified. So yeah, pen testing = known attack simulation sandboxing = discovering unknown threats That’s why B is the correct answer.

• Chose B2

  Sandboxing is the most effective technique for discovering unknown malicious attacks, especially zero-day threats (attacks exploiting previously unknown vulnerabilities). It involves executing suspicious code or files in an isolated, controlled environment (sandbox) where the program’s behavior can be safely observed without affecting production systems. --- Why “B” is correct: Sandboxing allows analysts to monitor how code behaves — whether it tries to: Modify system files Access unauthorized network resources Evade detection Since it doesn’t rely on known signatures, it can detect previously unknown or polymorphic malware. It’s widely used in advanced threat detection, malware analysis, and endpoint protection systems.

• Chose B3

  Sandboxing is the MOST effective technique among the options for discovering unknown malicious attacks, such as zero-day threats or malware with previously unseen behavior. Sandboxing isolates code (e.g., files, applications, attachments) in a controlled environment, allowing observation of its behavior without risking the actual system. It is particularly effective at detecting previously unknown (i.e., not signature-based) threats by analyzing what the code does, not just what it is. Why not the others? A. Penetration testing – Simulates known attack scenarios; it’s effective for identifying known vulnerabilities, but not unknown threats. C. Vulnerability testing – Focuses on scanning for known weaknesses, not discovering new or unknown malicious activity. D. Reverse engineering – Helps understand how malware works after it is discovered, but is time-consuming and reactive, not ideal for detecting unknown threats in real time.