Priya, a malware analyst, needs to run suspected malicious samples on her Windows laptop without letting them reach the host operating system or the corporate network. Which client-side virtualization use case does this describe?
- AA test-bed VM, a snapshot-based clone used to trial application patches before rolling them out across production desktops.
- BApplication virtualization, which streams a packaged app to the desktop so it runs without a local install or a full guest OS.
- CA cross-platform VM, used mainly to run a different operating system such as Linux alongside the Windows host for compatibility.
- DA sandbox, an isolated virtual machine used to detonate and observe untrusted code without exposing the host or production systems. Correct
Why A is wrong: Patch testing is a legitimate VM use, but its goal is validating updates, not deliberately containing hostile code, so it does not describe malware isolation.
Why B is wrong: App virtualization isolates one application from the host filesystem, but it shares the host kernel and is not built to safely detonate live malware.
Why C is wrong: Running a second OS for compatibility is a common VM benefit, but it says nothing about isolating and studying malicious samples, which is the stated need.
Why D is correct: A sandbox is a disposable, isolated VM whose whole purpose is to contain untrusted or malicious code so it cannot affect the host or the wider network.