ITPEC FE Morning October 2018 Question 46

Which of the following is an appropriate description of honeypots?

a)Antivirus software to detect and clean or quarantine virus-infected programsb)Computer system designed to detect or counteract unauthorized accessc)Firewall to detect and prevent unauthorized access to computer systemsd)Security mechanism to run untrusted programs without risking the computer

Explanation

A computer system designed to detect or counteract unauthorized access — a honeypot is a decoy that attracts attackers so their activity can be observed.

A honeypot looks like a real, often deliberately vulnerable, server but holds nothing of value and has no legitimate users. Any connection to it is therefore suspicious, so it detects intrusions, diverts attackers away from production systems and records their tools and methods for analysis.

Answer (b)

Why not others:

•(a) — detecting and cleaning or quarantining infected programs is antivirus software
•(c) — a firewall filters traffic at the network boundary to keep intruders out, whereas a honeypot invites them in
•(d) — running untrusted programs in an isolated environment without risk to the computer is a sandbox

Key rule: A honeypot works because nobody legitimate uses it: every access to it is a signal of attack.

Security · AI-written, may contain errors

Previous Next

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.