N10-009 Question 254
Single answerDeception technologies: Honeypot, HoneynetA security administrator wants to study how external attackers move laterally after gaining initial access, but the company does not want to expose production systems to additional risk. The administrator proposes deploying several decoy servers that imitate file, database, and web services on an isolated segment with tightly controlled monitoring. Which solution best meets this requirement?
- A
Deploy a honeynet that contains multiple monitored decoy systems isolated from production resources
- B
Deploy a single honeypot directly on the production VLAN so attackers can be observed interacting with real hosts
- C
Enable port mirroring on the core switch so the administrator can prevent all lateral movement attempts automatically
- D
Place a jump server in the DMZ to provide administrators with secure remote access to internal systems
Show answer and explanation
Correct answer: A
Explanation
The best answer is the honeynet because the scenario requires multiple decoy systems that imitate different services and allow defenders to study attacker behavior, including lateral movement, in an isolated environment. A honeypot is usually a single decoy host or service, while a honeynet is a collection of decoy systems designed to look like a small real network. Best practices for deception technologies include strong segmentation, restricted outbound connectivity, centralized logging, and careful monitoring so the environment can capture attacker techniques without creating additional exposure to production systems. This aligns with widely accepted security guidance from organizations such as NIST, which emphasizes network segmentation, monitoring, and containment when deploying security controls for detection and analysis.
- A. Correct.
Correct. A honeynet is a network of multiple honeypots or decoy systems designed to simulate a realistic environment for attackers. In this scenario, the goal is to observe attacker behavior across several service types and study lateral movement without increasing risk to production. Isolating the honeynet from production and closely monitoring it aligns with common deception technology best practices.
- B. Incorrect.
Incorrect. A honeypot is typically a single decoy system, so it does not best match the requirement to observe movement across multiple simulated hosts and services. Placing it directly on the production VLAN also increases risk because an attacker who compromises the decoy may gain a path closer to real assets. This option reflects the misconception that deception systems should sit inside production without strong segmentation.
- C. Incorrect.
Incorrect. Port mirroring can help capture traffic for analysis, but it does not create decoy assets and it does not automatically prevent lateral movement. It is a monitoring feature, not a deception technology. Someone might choose this option because monitoring is part of the scenario, but it does not satisfy the requirement to lure and study attacker behavior in a controlled environment.
- D. Incorrect.
Incorrect. A jump server is used to centralize and secure administrative access, often for management or remote administration. It is not a deception technology and does not provide decoy systems for observing attackers. This distractor targets confusion between security infrastructure and deception-based controls.