Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A security monitoring system triggers a high-severity alert showing that an internal corporate workstation initiated an unsolicited Server Message Block (SMB) connection attempt to an internal low-interaction deception host (honeypot). Which of the following best describes the security role of this alert and the immediate action the analyst should take?

  1. The alert indicates potential lateral movement or reconnaissance detected by a detective control; the analyst should isolate the originating workstation from the network for investigation.Answer
  2. B
    The alert indicates an active inline block performed by a preventive control; the analyst should reconfigure the honeypot firewall rules to drop the incoming traffic.
  3. C
    The alert indicates automated remediation by a corrective control; the analyst should re-image the honeypot host to clean up malicious payloads.
  4. D
    The alert indicates a network-level protocol flaw; the analyst should apply an emergency network firewall rule on the primary domain controller to drop internal SMB traffic.

Answer

The honeypot acts as a detective control detecting potential internal lateral movement, and the analyst should isolate the originating internal workstation for containment and triage.
Honeypots are deception technologies that function as detective controls. Because honeypots host no legitimate enterprise services or data, any inbound connection attempt indicates anomalous activity, internal reconnaissance, or lateral movement. Isolating the originating internal host limits potential threat proliferation.

Step-by-Step Solution

1
Analyze the alert source and target IP addresses.
Identified that an internal workstation attempted to connect to a low-interaction honeypot IP address.
Production hosts should never legitimately attempt connections to deception hosts within an enterprise network.
2
Determine the control classification of the deception host.
Recognized the honeypot as a detective control designed to monitor unauthorized access attempts and internal reconnaissance.
Honeypots do not act as inline filtering devices or automated corrective tools.
3
Select the appropriate incident containment procedure.
Recommend isolating the suspect internal workstation from the network.
Containment prevents potential lateral movement or data exfiltration while investigation takes place.

Key Concept

Deception Technology in Network Security Monitoring
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic