What is the difference between google sandbox & penalty??
This is debatable. The way I see it is that a new web site will require time to convince the search engine that it is of value to offer Internet searchers. Convincing the search engine of the site's credibility will require the ongoing deployment of unique, important, authentic, authoritatively crafted/optimized content. This needs to be done lightly. For example, if a web site starts off with 50 webpages, it wouldn't be wise to develop 2000 more pages a month and generate 10's of thousands of useless links to it. No, a 50 pager should grow maybe 4-5 pages a month until it has convinced the search engine of its value and develop links naturally.
I don't look at searchengine as slapping on penalties anymore. The search engine can devalue or demerit a web page because of excessive and poorly considered off-site influencing activities, basic on-site spamming (ie hidden content) or depreciation in the delivery of the quality of the content. There's a few other things too that can cause a webpage demerit but they are not common.