You are a cybersecurity analyst tasked with performing dynamic malware analysis on a suspicious file received by your organization. Your objective is…

The question is flawed as the most critical safety aspect—network isolation—is not an option. However, among the choices provided, host integrity monitoring (HIM) is the most relevant. While primarily an analysis technique, HIM tools (e.g., Sysmon, Regshot) monitor and log filesystem, registry, process, and network changes initiated by the malware. By observing these behaviors, including attempts to connect to external hosts or scan the local network, an analyst can detect and react to attempts to breach the isolated environment. This monitoring provides a layer of security through visibility, allowing for intervention before a potential breakout affects the production network.

B. Disabling antivirus is a common step to allow malware to run unhindered for analysis, but it is inherently a security-reducing action, not a safety measure.

C. Using physical machines does not guarantee safety; an improperly isolated physical machine is more dangerous than a properly isolated virtual one.

D. Using outdated operating systems is a technique to match a target environment but increases the sandbox's vulnerability and is not a safety design principle.

1. NIST Special Publication 800-83

Guide to Malware Incident Prevention and Handling for Desktops and Laptops (July 2005). Section 4.3

"Malware Analysis

" describes creating a controlled laboratory environment. It emphasizes network isolation as the primary safety control

but also discusses the need for monitoring tools to "record all the actions that the malware takes."

2. Sikorski

M.

& Honig

A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. Chapter 1

"Dynamic Analysis

" details the use of monitoring utilities like Process Monitor and Regshot to observe malware behavior

which is a form of host integrity monitoring. The book stresses that this occurs within a safe

isolated environment.

3. Ligh

M. H.

Case

A.

Levy

J.

& Walters

A. (2014). The Art of Memory Forensics: Detecting Malware and Threats in Windows

Linux

and Mac Memory. Wiley. While focused on memory

the book discusses dynamic analysis principles

including the necessity of monitoring system state changes (a core function of HIM) within a secure lab to understand malware impact.