ITPEC FE Morning April 2023 Question 43
Which of the following is a security measure that allows users to run potentially malicious programs on a system with the purpose of observing their behavior, while restricting the programs from accessing outside of the system?
Explanation
Sandbox — an isolated environment where a suspicious program runs so its behaviour can be watched without it reaching the rest of the system.
A sandbox gives the program only restricted access to files, memory and the network. Security products use it to open e-mail attachments or downloads and record what they try to do (write files, contact servers, change settings), while everything the program does stays inside the sandbox.
Answer (d)
Why not others:
- •(a) Firewall — filters traffic between networks by rules; it does not run programs
- •(b) Honeypot — a decoy system that lures attackers so their methods can be studied; it observes intruders, not programs a user chooses to run
- •(c) IPS — an intrusion prevention system inspects traffic and blocks attacks inline; it offers no isolated place to execute code
Key rule: Run untrusted code in a sandbox, lure attackers with a honeypot, filter traffic with a firewall and block detected attacks with an IPS.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.