The correct answer is A, Malware hiding. In CEH malware analysis concepts, a sandbox is a controlled and isolated environment used to execute suspicious files and observe their behavior safely. CEH-related material explains that dynamic or behavioral malware analysis is performed by executing malware in a sandbox environment, allowing analysts to observe processes, network connections, file changes, and other malicious activity. Sandbox evasion occurs when malware attempts to recognize that it is running inside an analysis environment and then hides, delays, or disables its malicious behavior. CEH-related content notes that advanced malicious applications may be designed to bypass sandboxing technology, commonly using fragmented code or sleep timers to avoid the inspection process. This makes the malware appear harmless during analysis. Firewall bypass and IDS bypass are network or detection-control evasion techniques, while encryption is only one possible obfuscation method. Therefore, sandbox evasion is best described as malware hiding.
