Examkin

Question

Difficulty: EasyNetwork Security Monitoring and Alerting

A security analyst is monitoring network alerts and observes repeated connection attempts targeting an isolated server in the DMZ. The server contains no actual production data or legitimate services and is specifically set up to decoy potential attackers. Which type of security tool is generating alerts for this monitored activity?

  1. A honeypot deployed to detect unauthorized activity and collect threat intelligenceAnswer
  2. B
    An inline Network Intrusion Prevention System (NIPS) active in blocking production network traffic
  3. C
    A Web Application Firewall (WAF) configured to sanitize Cross-Site Scripting (XSS) scripts
  4. D
    A perimeter router ACL applied to fix local application software vulnerabilities

Answer

A honeypot deployed to detect unauthorized activity and collect threat intelligence
A honeypot is a security mechanism designed to act as a decoy to lure cyberattackers. Because a honeypot does not host legitimate services or production data, any connection attempt to it generates a high-fidelity alert for security analysts to monitor and analyze threat tactics.

Step-by-Step Solution

1
Analyze the scenario context provided in the network security monitoring alert
Identified that the target system contains no production data and exists solely as a decoy target
Systems intended purely to attract and detect unauthorized interaction are deception technologies
2
Match the observed function to network security monitoring concepts
Recognized that a honeypot serves as a decoy monitoring tool to observe attack vectors and gather intelligence
Any interaction with a honeypot is inherently suspicious since it hosts no real business functions

Key Concept

Honeypot Deception and Network Security Monitoring
Estimated Time:45s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic