Examkin

Soru

Zorluk: OrtaDeception and Disruption Technologies

A security operations team configures an isolated network segment containing multiple fully functional decoy servers and simulated industrial control system (ICS) devices. The environment allows attackers to execute commands, run scripts, and interact extensively with system operating systems so analysts can capture advanced tactics, techniques, and procedures (TTPs). Which of the following deception technologies has been implemented?

  1. A
    DNS sinkhole
  2. High-interaction honeynetCevap
  3. C
    Inline intrusion prevention system
  4. D
    Low-interaction honeyfile

Cevap

High-interaction honeynet
A high-interaction honeynet uses a network of decoy systems that emulate genuine operating systems and services. It provides a rich environment for attackers to interact with, enabling security teams to study complex attack sequences without risking real production networks.

Adım Adım Çözüm

1
Analyze the requirements in the scenario
The scenario describes a network of fully functional decoy servers allowing extensive attacker interaction to gather intelligence on adversary TTPs.
Deception technologies are categorized by their deployment scope (individual host vs. network segment) and interaction level (low vs. high).
2
Distinguish between deception types and production controls
Multiple decoy systems configured on an isolated network segment form a honeynet. Because full OS functionality and deep engagement are allowed, it is classified as high-interaction.
High-interaction honeynets allow adversaries to interact directly with OS services to capture post-compromise activity.

Anahtar Kavram

Deception and Disruption Technologies - Honeynets and Interaction Levels
Bu soruyu puanla

Konular

Deception and Disruption Technologies

Bu konudan daha fazla soru