Sandboxing is a security technique that runs code inside an isolated, tightly restricted environment so it cannot reach or damage the rest of the host system.
You already rely on it constantly. Web browsers put each tab in its own sandbox so a malicious page cannot read your files. Mobile operating systems confine every app to its own storage and memory. Malware analysts detonate suspicious files inside a sandbox to watch what they do without risking a production machine. The boundary limits access to the filesystem, memory, network, and system calls.
Treat it as one layer rather than a promise. Sandbox escape bugs are valuable precisely because isolation is hard to get perfect, and plenty of modern malware checks whether it is running in an analysis sandbox and simply stays dormant until it thinks a real user is present. Good design assumes the sandbox might fail and keeps other controls behind it.
Why does sandboxing matter for the CISSP exam?
It sits in Domain 3, Security Architecture and Engineering, weighted at 13%. The exam frames sandboxing as an application of isolation and least privilege, so know how it relates to virtualization, containment, and the idea of a security boundary between processes.