Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A security operations center analyst receives a high-severity alert from a network security monitoring system watching a dedicated deception host (honeypot) located inside a monitored subnet segment. The alert logs multiple inbound connection attempts on TCP port 22 originating from an external IP address. The analyst immediately submits an emergency change request to reconfigure the honeypot host's local firewall to block port 22 incoming traffic to mitigate the risk of compromise. Which of the following best evaluates the analyst's action?

  1. The analyst's action is flawed because honeypots are designed to attract and observe unauthorized activity, and blocking traffic prevents intelligence gathering.Answer
  2. B
    The analyst's action is correct because honeypots should be reclassified as inline preventive controls whenever active probe alerts trigger.
  3. C
    The analyst should have initiated automated host isolation playbooks across all internal production domain controllers instead of modifying the host.
  4. D
    The analyst failed to recognize that port 22 connection attempts in NIDS logs indicate false positive alerts generated by standard HTTPS web browsing.

Answer

The analyst's action is flawed because honeypots are designed to attract and observe unauthorized activity, and blocking traffic prevents intelligence gathering.
The correct answer highlights that a honeypot is a deception control specifically built to attract unauthorized network interactions to study adversary tactics, techniques, and procedures (TTPs). Applying inline block rules directly on the honeypot prevents analysts from gathering security intelligence and defeats the system's purpose.

Step-by-Step Solution

1
Analyze the function of the target security asset mentioned in the monitoring alert.
The target asset is identified as a honeypot (deception host) designed specifically to draw attack traffic into an isolated environment.
Understanding the baseline purpose of the monitored system is essential for proper incident response and alert triage.
2
Evaluate the analyst's proposed remediation action against security monitoring goals.
Blocking port 22 traffic on the honeypot prevents the system from fulfilling its purpose of gathering threat intelligence and observing attack tactics.
Honeypots rely on accepting unauthorized connections in a controlled environment to generate high-fidelity alerts and telemetry.
3
Select the option that correctly identifies the conceptual flaw in the analyst's response.
Recognizing that honeypot controls are intended for detection and intelligence rather than inline prevention leads to the correct option.
Modifying a honeypot to block scans disrupts network security monitoring and intelligence operations.

Key Concept

Honeypot Alerting and Deception Technology Monitoring
Estimated Time:1m 30s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic