SY0-701 Question 22
Single answerDeception and disruption technology: Honeypot , Honeynet , Honeyfile , HoneytokenA security team suspects an attacker has limited access to an internal file share and may be browsing sensitive project folders without triggering existing malware signatures. The team wants to detect unauthorized access quickly without disrupting legitimate users or exposing real confidential data. Which solution would BEST meet this requirement?
- A
Deploy a honeyfile in the project folders with embedded alerting when it is opened or copied
- B
Deploy a honeynet that mirrors the entire production file server environment for all employees
- C
Place a honeypot on the perimeter firewall to replace the file share temporarily
- D
Issue honeytokens to all employees as replacement domain credentials for daily use
Show answer and explanation
Correct answer: A
Explanation
The best answer is the honeyfile because the scenario is specifically about detecting unauthorized access within a file share while avoiding disruption and protecting real sensitive data. A honeyfile is designed for exactly this purpose: it acts as a bait document that should not be accessed during normal operations, so any interaction with it is a strong indicator of suspicious activity. By contrast, a honeypot is a decoy system, a honeynet is a collection of decoy systems used for larger-scale observation, and a honeytoken is a broader category of decoy data such as fake credentials or records. Security best practices for deception technology emphasize choosing the least disruptive control that provides high-fidelity alerts. This makes a honeyfile the most appropriate and practical option in this case.
- A. Correct.
Correct. A honeyfile is a decoy file placed in a location where an attacker is likely to find it. It contains no real sensitive data, but access to it can generate an alert, making it well suited for detecting unauthorized browsing or data theft attempts on internal file shares. This aligns directly with the requirement to detect suspicious access without affecting legitimate business operations.
- B. Incorrect.
Incorrect. A honeynet is a network of decoy systems designed to attract and study attackers, often used for broader monitoring and threat research. It is much more complex than necessary for this use case and would not be the best fit for simply detecting access to suspicious files within an existing internal share.
- C. Incorrect.
Incorrect. A honeypot is a decoy system or service intended to lure attackers, but replacing a real file share with a honeypot would disrupt legitimate users and would not satisfy the requirement to avoid operational impact. Also, a perimeter firewall is not the right place to 'replace' an internal file share with a decoy resource.
- D. Incorrect.
Incorrect. Honeytokens are decoy pieces of data such as fake credentials, API keys, or database entries used to detect misuse if they are accessed or used. However, issuing them as employees' daily credentials would create operational and security problems. Honeytokens should be planted as decoys, not used as real working credentials.