Examkin

Question

Difficulty: Very hardDeception and Disruption Technologies

A security operations team wants to identify unauthorized credential harvesting and post-exploitation lateral movement within a hybrid cloud enterprise network. To achieve this without altering production network routing or risking asset compromise, the team injects synthetic cloud API keys and decoy Kerberos ticket-granting service (TGS) requests into the LSASS memory space of critical endpoints. When an attacker attempts to extract these fake credentials and present them to a decoy authentication service, an alert is triggered immediately. Which of the following deception and disruption technologies did the organization deploy?

  1. Honeytokens acting as breadcrumbsAnswer
  2. B
    A high-interaction honeynet enforcing inline network isolation
  3. C
    DNS sinkholing integrated with an intrusion prevention system (IPS)
  4. D
    Honeyfiles functioning as preventive compensating controls

Answer

Honeytokens acting as breadcrumbs
The deployment of synthetic API keys and decoy Kerberos credentials directly into endpoint memory represents the use of honeytokens configured as breadcrumbs. Honeytokens are deceptive data items or fake credentials that trigger alerts upon unauthorized use, while breadcrumbs are host-based artifacts placed to entice attackers toward decoy resources.

Step-by-Step Solution

1
Analyze the technical requirements of the scenario.
The organization needs to detect post-exploitation credential harvesting and lateral movement from host memory without impacting production routing.
Traditional perimeter defenses often miss lateral movement when legitimate tools or stolen memory credentials are used.
2
Evaluate the deployed deceptive elements.
The deployed artifacts are fake credentials (synthetic API keys and decoy Kerberos TGS tickets) placed on endpoints to guide adversaries into decoy authentication traps.
Fake credentials or data items designed to trigger alerts when accessed are classified as honeytokens, and when strategically left on host systems to lure attackers, they function as breadcrumbs.
3
Differentiate honeytokens/breadcrumbs from network honeynets, traditional IPS controls, and honeyfiles.
Decoy host memory credentials map precisely to honeytokens serving as breadcrumbs rather than network-level honeynets, DNS sinkholes, or file-based honeyfiles.
Honeytokens target credential usage and memory inspection, while honeyfiles target file system operations and honeynets simulate entire network segments.

Key Concept

Deception Technologies: Honeytokens and Breadcrumbs
Rate this question

Topics

Deception and Disruption Technologies

More questions from this topic