ITPEC FE Morning April 2022 Question 45

Honey pot — a decoy system or network left deliberately vulnerable to attract intruders and malware so their behavior can be observed.

A honey pot holds no real business data, so any access to it is suspicious by definition. Logging what intruders or malware do there reveals their tools, techniques and targets, and it can divert attacks away from the real systems.

Answer (c)

Why not others:

• •(a) Botnet — a network of computers infected with bots and controlled remotely by an attacker, used for DDoS attacks or spam; it is the attacker's tool, not a trap for studying attackers
• •(b) DMZ — a network segment between the Internet and the internal network for public servers; it is meant to be protected, not deliberately weakened
• •(d) SIEM — Security Information and Event Management collects and correlates logs from many devices to detect incidents on the real systems; it does not lure attackers

Key rule: Defensive measures differ by purpose: a DMZ separates, an IDS or SIEM detects attacks on production systems, and only a decoy exists to be attacked and watched.

Security · AI-written, may contain errors