Examkin

Question

Difficulty: MediumDeception and Disruption Technologies

A security operations team configures an isolated network segment containing multiple fully functional decoy servers and simulated industrial control system (ICS) devices. The environment allows attackers to execute commands, run scripts, and interact extensively with system operating systems so analysts can capture advanced tactics, techniques, and procedures (TTPs). Which of the following deception technologies has been implemented?

  1. A
    DNS sinkhole
  2. High-interaction honeynetAnswer
  3. C
    Inline intrusion prevention system
  4. D
    Low-interaction honeyfile

Answer

High-interaction honeynet
A high-interaction honeynet uses a network of decoy systems that emulate genuine operating systems and services. It provides a rich environment for attackers to interact with, enabling security teams to study complex attack sequences without risking real production networks.

Step-by-Step Solution

1
Analyze the requirements in the scenario
The scenario describes a network of fully functional decoy servers allowing extensive attacker interaction to gather intelligence on adversary TTPs.
Deception technologies are categorized by their deployment scope (individual host vs. network segment) and interaction level (low vs. high).
2
Distinguish between deception types and production controls
Multiple decoy systems configured on an isolated network segment form a honeynet. Because full OS functionality and deep engagement are allowed, it is classified as high-interaction.
High-interaction honeynets allow adversaries to interact directly with OS services to capture post-compromise activity.

Key Concept

Deception and Disruption Technologies - Honeynets and Interaction Levels
Rate this question

Topics

Deception and Disruption Technologies

More questions from this topic