A security defense team is implementing active deception and disruption controls across an enterprise environment to improve threat detection and mitigation. Match each deception or disruption technology on the left with its corresponding operational security objective on the right.
- DNS SinkholeIntercepts known malicious outbound command-and-control domain lookups and redirects traffic to a controlled monitoring IP address.
- HoneyfileDecoy file placed on a shared directory configured with access auditing to trigger alerts upon unauthorized viewing.
- HoneytokenFake credential set or API key embedded within code or database entries to detect unauthorized credential usage.
- Low-Interaction HoneypotSimulated system or network service designed to mimic basic protocol responses while minimizing underlying OS exposure.
Answer
DNS Sinkhole matches with C2 domain lookup interception; Honeyfile matches with decoy file auditing; Honeytoken matches with fake credentials or API key detection; Low-Interaction Honeypot matches with simulated service basic protocol response.
Each technology is paired correctly based on its core implementation: DNS sinkholes redirect malicious DNS queries; honeyfiles act as audited decoy documents; honeytokens serve as fake digital credentials/keys; and low-interaction honeypots emulate basic network services to capture initial probes.
Step-by-Step Solution
Key Concept
Deception and Disruption Technologies