ITPEC FE Morning April 2020 Question 44
Which of the following is the network security tool that is usually deployed by a network or system administrator and presents itself as a target machine trying to lure attackers to observe their behavior and attack methodology without harming other systems?
Explanation
Honeypot — a decoy system deliberately exposed to attract attackers so their methods can be observed safely.
A honeypot looks like a real, often vulnerable server, but it holds nothing of value and is isolated from production systems. Any traffic to it is suspicious by definition, so administrators can record the attacker's tools and techniques and use them to improve defences, without putting other systems at risk.
Answer (a)
Why not others:
- •(b) Logic analyzer — an electronic test instrument that captures and displays digital signals in a circuit; not a network security tool
- •(c) Protocol analyzer — captures and decodes network packets for troubleshooting or monitoring; it observes traffic but does not pose as a target
- •(d) Rootkit — a set of tools the attacker installs to keep access and hide the intrusion; an attack tool, not a defender's
Key rule: A honeypot (or a network of them, a honeynet) is a lure for observing attackers; a protocol analyzer only watches traffic that already exists.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.