ISC2 CISSP Practice Question

The correct action is to execute the file in a sandbox. A sandbox is an isolated, controlled environment where potentially malicious code can be run and analyzed without affecting the production system or network. This allows the analyst to observe the file's behavior, such as network connections, file modifications, or registry changes, to determine if it is malicious. Deleting the email removes the immediate threat but prevents analysis. Running a local AV scan may not detect an unknown or zero-day threat. Forwarding to a vendor is a valid step but not the best initial action for immediate internal analysis.