What type of system is used to contain an attacker to allow them to be monitored?

What type of system is used to contain an attacker to allow them to be monitored?

• A. Firewalls
• B. Intrusion Detection Systems
• C. VPNs
• D. Sandboxes

Answer: (D)

Containment of an attacker in a controlled, isolated environment allows you to observe their actions safely. A sandbox is designed to run potentially hostile code or an attacker’s interactions in a restricted space where permissions, resources, and network access are tightly controlled. This separation prevents harm to the real system while enabling detailed monitoring and logging of every action the attacker tries—file changes, process creation, network calls, and privilege attempts. With instrumentation and strict confinement, security teams can study the attacker’s techniques, detect what they’re trying to do, and gather evidence without risking broader access. Firewalls focus on filtering traffic at the network boundary, not on isolating and observing an attacker inside a system. Intrusion Detection Systems monitor for suspicious activity but don’t confine an attacker to a separate environment. VPNs create secure connections for remote access and don’t provide containment or detailed monitoring of attacker behavior within the system. So, using a sandbox to contain and monitor an attacker is the approach that fits this purpose best.

Containment of an attacker in a controlled, isolated environment allows you to observe their actions safely. A sandbox is designed to run potentially hostile code or an attacker’s interactions in a restricted space where permissions, resources, and network access are tightly controlled. This separation prevents harm to the real system while enabling detailed monitoring and logging of every action the attacker tries—file changes, process creation, network calls, and privilege attempts. With instrumentation and strict confinement, security teams can study the attacker’s techniques, detect what they’re trying to do, and gather evidence without risking broader access.

Firewalls focus on filtering traffic at the network boundary, not on isolating and observing an attacker inside a system. Intrusion Detection Systems monitor for suspicious activity but don’t confine an attacker to a separate environment. VPNs create secure connections for remote access and don’t provide containment or detailed monitoring of attacker behavior within the system.

So, using a sandbox to contain and monitor an attacker is the approach that fits this purpose best.