You're ready to run a sample dynamically. Which environment is appropriate?
Short answer
Detonate only in a disposable, isolated VM with snapshots and a controlled network (e.g., simulated services or tightly monitored egress) so the malware can't reach production or the internet uncontrolled. AV on your laptop won't reliably contain live malware. A production server risks real systems. A colleague's machine just moves the danger. Isolation and revertable snapshots are the core of a safe malware lab.
Choosing where to detonate is a containment decision, not a convenience one. The interviewer wants to hear that you treat live malware as something that will try to spread, and that you build an environment assuming it succeeds.
Why an isolated, snapshotted VM is correct
A proper detonation lab gives you three things. Isolation: the VM has no route to production systems or uncontrolled internet, so a worm or ransomware payload has nowhere to go. Snapshots: you capture a clean baseline before each run and revert afterward, so every analysis starts pristine and nothing persists. A controlled network: either fully simulated services (fake DNS, HTTP, SMTP) or a tightly monitored, filtered egress, so you can observe C2 and downloads without exposing real infrastructure. That combination lets you watch the malware do its worst, safely, and reset in seconds.
Why the other options are wrong
- Your daily laptop with antivirus on. AV detects known threats; it does not contain a live, possibly novel sample. A miss means your working machine — full of credentials and network access — is now infected. You also lose a clean baseline.
- A spare production server after hours. "Spare" and "production" don't mix. That server shares the production network and trust relationships, so a successful infection can reach real systems and real data. Off-hours only changes who notices.
- A colleague's machine. This is purely irresponsible: you've not contained anything, you've just relocated the blast radius onto someone who didn't consent and may not even know.
What interviewers look for
Strong candidates describe the lab as disposable and revertable, name the network options (simulated vs. monitored egress), and mention guarding against VM escape and accidental bridging. The signal is that you design for failure: assume the malware breaks out and make sure that, when it tries, it lands on nothing valuable and you can wipe it clean with a snapshot revert.
Likely follow-ups
- How do you prevent VM escape or accidental network bridging from your detonation host to production?
- What's the trade-off between fully simulated network services and tightly monitored real egress for capturing behavior?
- Why are snapshots before each run essential, and what do you reset between samples?