Security+ Deception Technology and Honeypots

1. Deception technology includes honeypots, honeynets, and canaries. Which serves as a single decoy file or process?

Honeypot

Honeynet

Honey canary

Honeytrap

2. What is a significant limitation of honeypots in detecting advanced persistent threats (APTs)?

They consume excessive bandwidth

Sophisticated attackers may recognize and avoid honeypots

They require constant rebooting

They cannot capture encrypted traffic

Submit

4. Which of the following data should honeypots collect for effective threat intelligence? (Select all that apply)

Attack source IP addresses

Malware samples and payloads

Employee credentials

Attack techniques and timing

Submit

5. Honeypots are isolated from production systems to prevent lateral movement by attackers. True or False?

True

False

6. What should be the network placement of a honeypot to maximize threat detection?

Outside the firewall only

Inside the firewall only

Both inside and outside the firewall (DMZ and internal networks)

Isolated from all networks

Submit

8. Which tool is commonly used to monitor and manage honeypot interactions and collect threat intelligence?

Wireshark

Snort

Splunk

All of the above

9. Honeypots can generate false positives that waste security analyst time. True or False?

True

False

10. What is the primary advantage of using canaries in security architecture?

They encrypt sensitive data

They alert when accessed, indicating a potential breach

They prevent all network attacks

They replace intrusion detection systems

11. What is the primary purpose of a honeypot in a security architecture?

To encrypt all network traffic

To detect and study unauthorized access attempts

To replace firewalls entirely

To authenticate user credentials

Submit

13. Which security framework commonly recommends honeypots as part of defense-in-depth strategy?

ISO 27001

NIST Cybersecurity Framework

PCI DSS

SOC 2

14. What is a key risk of deploying a honeypot within a production network?

It consumes too much electricity

Attackers might use it as a pivot point to access legitimate systems

It interferes with DNS resolution

It automatically blocks all traffic

15. Honeypots can be classified as production or research based on their deployment location. True or False?

True

False

Submit

17. Which of the following are benefits of deploying honeypots? (Select all that apply)

Early warning of attacks

Collection of malware samples

Increased network bandwidth

Identification of attack patterns

Submit

18. What advantage does a high-interaction honeypot provide over a low-interaction honeypot?

Lower resource consumption

More realistic attack simulation and deeper threat intelligence

Faster deployment

Reduced maintenance requirements

19. A low-interaction honeypot emulates services with minimal functionality. True or False?

True

False

20. Which type of honeypot is designed to simulate an entire network of vulnerable systems?

Low-interaction honeypot

High-interaction honeypot

Honeynet

Honeytrap

Security+ Deception Technology and Honeypots Quiz

1. Deception technology includes honeypots, honeynets, and canaries. Which serves as a single decoy file or process?

2.

What first name or nickname would you like us to use?

2. What is a significant limitation of honeypots in detecting advanced persistent threats (APTs)?

3. A _____ is a deception technique that plants fake credentials to detect unauthorized access attempts.

4. Which of the following data should honeypots collect for effective threat intelligence? (Select all that apply)

5. Honeypots are isolated from production systems to prevent lateral movement by attackers. True or False?

6. What should be the network placement of a honeypot to maximize threat detection?

7. A _____ honeypot is designed to be deployed quickly in response to detected suspicious activity.

8. Which tool is commonly used to monitor and manage honeypot interactions and collect threat intelligence?

9. Honeypots can generate false positives that waste security analyst time. True or False?

10. What is the primary advantage of using canaries in security architecture?

11. What is the primary purpose of a honeypot in a security architecture?

12. A honeypot that runs actual vulnerable services to capture attacker behavior is classified as _____ interaction.

13. Which security framework commonly recommends honeypots as part of defense-in-depth strategy?

14. What is a key risk of deploying a honeypot within a production network?

15. Honeypots can be classified as production or research based on their deployment location. True or False?

16. A _____ is a honeypot designed to look like a database server containing sensitive financial records.

17. Which of the following are benefits of deploying honeypots? (Select all that apply)

18. What advantage does a high-interaction honeypot provide over a low-interaction honeypot?

19. A low-interaction honeypot emulates services with minimal functionality. True or False?

20. Which type of honeypot is designed to simulate an entire network of vulnerable systems?