Exam CAS-004 topic 1 question 563 discussion

Sandbox detonation is the most appropriate option for developing a comprehensive list of Indicators of Compromise (IoCs) as it allows for in-depth analysis of malware behavior and the extraction of all relevant IoCs. These IoCs can then be used to detect if similar attacks or malware variants are present within the organization’s environment. By detonating the malware in a sandbox environment, security teams can capture all relevant IoCs associated with the malware, allowing them to detect whether the same attack or variant might be targeting their organization. Therefore, the correct answer is B. Sandbox detonation.