In a multinational corporation, there have been increasing reports of system crashes and data leaks...

Option B. Cuckoo Sandbox is the best answer because CHFI v11 explicitly includes Malware Analysis: Static and Dynamic , the Prominence of Setting up a Controlled Malware Analysis Lab , Preparing Testbed for Malware Analysis , and Tools to Perform Static and Dynamic Malware Analysis . The question specifically asks for behavioral analysis in a secure and controlled environment , which is the hallmark of sandbox-based dynamic malware analysis.

A polymorphic worm that changes structure rapidly is difficult to analyze with signature-based approaches alone, so observing its behavior in a sandbox is the most effective next step. Cuckoo Sandbox is designed for this type of controlled execution and can reveal process activity, file changes, registry modifications, network communications, and persistence behavior without exposing the production environment. Wireshark only captures network traffic. IDA Pro is a reverse engineering tool for code analysis. Process Monitor is useful for local system monitoring but does not provide the same isolated malware-analysis lab capability.

Therefore, under CHFI malware-forensics objectives, Cuckoo Sandbox is the strongest answer for secure behavioral analysis of the worm.