A security operations team is implementing an active defense strategy across a enterprise network to detect lateral movement and credential theft. Match each deception technology implementation on the left with its corresponding active defense classification on the right.
- Injecting fake database connection strings into endpoint memory to alert security teams when dumped by malwareHoneytoken
- Deploying an interconnected subnet of intentionally vulnerable virtual machines simulating a corporate Active Directory infrastructureHoneynet
- Placing an attractive financial audit spreadsheet on a shared network drive embedded with an invisible phone-home beaconHoneyfile
- Adding false DNS records and browser history entries to endpoint hosts to steer network scanners toward a monitoring gatewayBreadcrumb
Cevap
Matching pairs: Endpoint memory strings -> Honeytoken; Interconnected virtual subnet -> Honeynet; Financial audit spreadsheet -> Honeyfile; False DNS records and browser entries -> Breadcrumb.
Each deception technology fulfills a distinct operational role in active defense strategy. Honeytokens are data-level artifacts such as fake keys or connection strings. Honeynets provide comprehensive, multi-system network decoys to observe attacker behavior. Honeyfiles rely on fake documents containing tracking mechanisms. Breadcrumbs consist of host artifacts configured on active production systems to guide threat actors into deceptive environments.
Adım Adım Çözüm
Anahtar Kavram
Deception and Disruption Technologies