Examkin

Question

Difficulty: EasyNetwork Security Monitoring and Alerting

During network telemetry monitoring, a security technician observes an alert generated when an internal workstation attempts an unauthorized connection to a non-production server that contains simulated sensitive files and no real enterprise services. Which of the following network security monitoring concepts is actively being utilized in this scenario?

  1. A honeypot deployed as a deception mechanism to detect unauthorized internal accessAnswer
  2. B
    An inline Web Application Firewall filtering Cross-Site Scripting attempts
  3. C
    A stateful firewall operating as a preventive network control to block malicious port scans
  4. D
    An inline intrusion prevention rule deployed to mitigate operating system buffer overflow exploits

Answer

A honeypot deployed as a deception mechanism to detect unauthorized internal access
A honeypot is a security control designed to act as a decoy to lure potential attackers or unauthorized users. Because a honeypot has no legitimate business purpose or real production traffic, any interaction or connection attempt made to it generates a high-confidence alert for security analysts.

Step-by-Step Solution

1
Analyze the network monitoring scenario
Identified a non-production decoy server designed with simulated data to attract interaction.
Security monitoring systems use intentionally vulnerable or decoy assets to alert security teams of lateral movement or unauthorized scanning.
2
Evaluate the security mechanism type
Decoy systems intended for detection and threat intelligence gathering are classified as honeypots.
Honeypots do not serve legitimate business functions, so any connection attempt to one triggers a high-fidelity alert.

Key Concept

Honeypots and Deception Technologies in Network Security Monitoring
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic