A cybersecurity team is deploying deception and disruption technologies within a cloud-native software development environment to detect early-stage credential access and lateral movement. Which of the following components and operational practices should the security team implement to achieve high-fidelity alerting without interfering with legitimate production workflows? (Select TWO.)
- Embed non-functional synthetic API keys (honeytokens) into code repositories that generate alerts upon any authorization attempt.Answer
- Deploy low-interaction decoy container endpoints on isolated microsegments to simulate high-value internal management services.Answer
- CPosition inline honeypot appliances between front-end web servers and production databases to inspect and drop malicious traffic.
- DReconfigure internal DNS servers to drop outbound traffic directed toward unapproved external domain names.
Answer
The correct practices are embedding non-functional synthetic API keys (honeytokens) into code repositories to alert on any access attempt, and deploying low-interaction decoy container endpoints on isolated network segments to detect probing without risking production infrastructure.
Deception strategies rely on deploying assets that serve no legitimate business purpose. The option stating that non-functional synthetic API keys (honeytokens) should be placed in code repositories is correct because any interaction with these keys immediately signals unauthorized discovery or credential harvesting. The option recommending low-interaction decoy container endpoints on isolated microsegments is also correct because it provides a lightweight decoy target to capture lateral movement probes without exposing production systems.
Step-by-Step Solution
Key Concept
Deception and Disruption Technologies Deployment
Estimated Time:1m 30s