Examkin

Soru

Zorluk: OrtaDeception and Disruption Technologies

A cybersecurity team is deploying deception and disruption technologies within a cloud-native software development environment to detect early-stage credential access and lateral movement. Which of the following components and operational practices should the security team implement to achieve high-fidelity alerting without interfering with legitimate production workflows? (Select TWO.)

  1. Embed non-functional synthetic API keys (honeytokens) into code repositories that generate alerts upon any authorization attempt.Cevap
  2. Deploy low-interaction decoy container endpoints on isolated microsegments to simulate high-value internal management services.Cevap
  3. C
    Position inline honeypot appliances between front-end web servers and production databases to inspect and drop malicious traffic.
  4. D
    Reconfigure internal DNS servers to drop outbound traffic directed toward unapproved external domain names.

Cevap

The correct practices are embedding non-functional synthetic API keys (honeytokens) into code repositories to alert on any access attempt, and deploying low-interaction decoy container endpoints on isolated network segments to detect probing without risking production infrastructure.
Deception strategies rely on deploying assets that serve no legitimate business purpose. The option stating that non-functional synthetic API keys (honeytokens) should be placed in code repositories is correct because any interaction with these keys immediately signals unauthorized discovery or credential harvesting. The option recommending low-interaction decoy container endpoints on isolated microsegments is also correct because it provides a lightweight decoy target to capture lateral movement probes without exposing production systems.

Adım Adım Çözüm

1
Analyze the goal of deception technologies in a cloud environment.
Identified that deception mechanisms (like honeytokens and decoys) aim to lure adversaries into interacting with non-production assets to produce high-confidence alerts.
Deception assets have no legitimate operational traffic, making any interaction suspicious.
2
Evaluate the proposed deception components against production safety and intent.
Selected honeytokens in code repositories and low-interaction decoy containers as proper deception tools.
Honeytokens detect credential misuse, and low-interaction containers catch scanning and discovery efforts safely.
3
Differentiate deception tools from standard inline prevention and filtering controls.
Disqualified inline traffic filtering and DNS dropping controls.
Honeypots do not act as inline filtering devices, and DNS filtering is a preventive control rather than a deception technology.

Anahtar Kavram

Deception and Disruption Technologies Deployment
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Deception and Disruption Technologies

Bu konudan daha fazla soru