A security infrastructure team is establishing proactive defense capabilities across an enterprise environment. Match each disruption or deception technology on the left with the scenario that best illustrates its primary operational objective on the right.
- Low-interaction honeypotEmulating basic network service banners to quickly detect unauthorized port scanning while consuming minimal host resources.
- High-interaction honeypotCapturing and analyzing complex zero-day exploitation techniques within a fully operational, simulated server operating system.
- DNS sinkholeIntercepting outbound malicious domain queries from compromised internal hosts to disrupt command-and-control communications.
- HoneytokenEmbedding decoy cloud API keys into internal source code repositories to generate instant telemetry upon unauthorized access.
Answer
Low-interaction honeypot matches with emulating basic network service banners; High-interaction honeypot matches with capturing complex zero-day exploitation within a fully operational OS; DNS sinkhole matches with intercepting outbound malicious domain queries; Honeytoken matches with embedding decoy cloud API keys into source code repositories.
Each deception and disruption technology aligns with its core functionality: low-interaction honeypots emulate basic services for low-overhead scanning alerts; high-interaction honeypots run complete operating systems for detailed behavioral analysis; DNS sinkholes block external attacker communication by altering DNS responses; honeytokens serve as decoy credentials to detect unauthorized repository exposure.
Step-by-Step Solution
Key Concept
Deception and Disruption Technologies