Examkin

Question

Difficulty: MediumDeception and Disruption Technologies

A security operations team configures an isolated decoy server on an internal network. The server runs a complete, fully functional operating system with authentic services and interactive shells designed to capture advanced attacker tools, command-line techniques, and lateral movement tactics in real time. Which of the following deception technologies has the team implemented?

  1. High-interaction honeypotAnswer
  2. B
    Low-interaction honeypot
  3. C
    Honeytoken
  4. D
    Inline intrusion prevention system

Answer

High-interaction honeypot
A high-interaction honeypot presents a real, fully operational environment with authentic operating system services. This enables security teams to observe sophisticated post-exploitation behavior, capture custom tools, and analyze an attacker's manual command execution.

Step-by-Step Solution

1
Analyze the operational capabilities described in the scenario
The target system requires a complete, fully functional operating system with interactive command shell access to record advanced adversary tactics.
Deception technologies are categorized by their level of interactivity, complexity, and operational exposure.
2
Compare high-interaction and low-interaction deception implementations
High-interaction honeypots run real operating systems and full services, whereas low-interaction honeypots only emulate basic network listeners or fixed protocol responses.
Providing genuine interactive shells and complete OS functionality is the defining characteristic of a high-interaction honeypot.

Key Concept

Deception and Disruption Technologies - High-Interaction Honeypot
Rate this question

Topics

Deception and Disruption Technologies

More questions from this topic