SY0-701 Question 21
Single answerDeception and disruption technology: Honeypot , Honeynet , Honeyfile , HoneytokenA security analyst wants early warning if an attacker gains access to the internal file share that stores engineering documents. The company does not want to expose additional hosts on the network or maintain a full decoy environment. Instead, the analyst wants to place a fake document in the share so that any attempt to open, copy, or exfiltrate it will generate an alert because legitimate users should never access it. Which deception technology best meets this requirement?
- A
Deploy a honeypot that emulates a vulnerable file server
- B
Create a honeynet that contains multiple decoy systems and services
- C
Place a honeyfile in the engineering share and monitor for access
- D
Insert a honeytoken into the perimeter firewall rule set
Show answer and explanation
Correct answer: C
Explanation
The best answer is to place a honeyfile in the engineering share and monitor for access. In Security+ terms, deception technologies should be matched to the detection goal and operational constraints. A honeyfile is specifically appropriate when defenders want to detect unauthorized browsing or exfiltration of file repositories with minimal infrastructure overhead. By contrast, a honeypot is a standalone decoy host or service, and a honeynet is a larger collection of decoy systems used for broader visibility and attacker analysis. A honeytoken is a general category of deceptive digital artifact, often including fake credentials, records, or links; a honeyfile is one practical implementation of that concept. This approach aligns with common defensive best practices: use high-confidence indicators that legitimate users should not touch, log all interactions, and integrate alerts with SIEM/SOAR workflows for rapid investigation.
- A. Incorrect.
Incorrect. A honeypot is a decoy system or service designed to attract attackers, such as a fake server that appears vulnerable. While it can detect malicious interaction, it does not match the requirement to avoid deploying additional hosts and simply place a fake document in an existing share.
- B. Incorrect.
Incorrect. A honeynet is a network of multiple honeypots or decoy systems used to observe attacker behavior across a broader environment. This is more complex to deploy and maintain than the scenario requires, and it directly conflicts with the goal of not maintaining a full decoy environment.
- C. Correct.
Correct. A honeyfile is a decoy file placed where an attacker may find it, such as a file share, endpoint, or cloud storage location. Because no legitimate user should access it, any open, copy, or exfiltration attempt is high-fidelity evidence of suspicious activity. This directly satisfies the requirement for a fake document on the existing share without adding new hosts.
- D. Incorrect.
Incorrect. A honeytoken is a broader term for a planted decoy artifact such as fake credentials, API keys, database records, or other digital bait that generates an alert when used. Although a honeyfile can be considered a type of honeytoken in a broad sense, placing one into a firewall rule set is not the correct implementation for detecting file-share access in this scenario.