A malware analyst has completed static analysis of a suspicious executable and is preparing to observe its runtime behavior in a dedicated analysis lab. Before detonating the sample, the analyst wants to capture the malware's command-and-control callback attempts and dropped payloads without risking the corporate network or tipping off the attacker's infrastructure. Which configuration should the analyst apply to the dynamic analysis environment before executing the sample?