ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The operating system's native disposable sandbox feature launches the browser inside a lightweight, hardware-assisted virtual machine that is completely discarded when the window is closed. Because the sandbox is non-persistent, any malware that executes or any changes made during the session disappear automatically, protecting the underlying endpoint. A designated shared folder can be used to copy downloaded files to the host for separate malware scanning. A proxy or HIPS can reduce risk but still leaves the browser running on the primary OS, so persistent changes or zero-day exploits could survive. Requiring full VMs with manual snapshot reversion would provide isolation but fails the requirement for minimal additional overhead and administrative effort. Therefore, enabling the built-in browser sandbox is the most effective and efficient solution.