English
Menu

Cyber Attacks and Defense in Practice

An organization places "decoy" files that nobody uses for work, and a decoy administrator account that no system uses, on an internal file server, and monitors access to them. Which of the following is the main advantage of this measure?

  1. AWith decoys in place, attackers will always target only the decoys, so the real files and accounts will no longer be attacked
  2. BThe decoy account can also be used for everyday work, so there is no need to reduce the number of administrator accounts
  3. CLegitimate users have no reason to touch them, so any access is a strong clue of intrusion with few false positives
Show answer and explanation

Answer: C. Legitimate users have no reason to touch them, so any access is a strong clue of intrusion with few false positives

Decoys that are not used for work (called honeypots, honeytokens, decoys and so on) give legitimate users no reason to touch them, so the very fact that they were accessed is a strong sign of something abnormal. Unlike anomaly-based detection, there is no need to judge from differences from the normal state, and the advantage is that there are few false positives. Intruders explore the inside looking for administrator accounts and important-looking files, so mixing decoys among them may reveal lateral movement at an early stage. However, decoys do not stop the real assets from being attacked, so they are a supplementary measure combined with other controls.

  • A. Attackers do not necessarily target only the decoys. Other controls that protect the real assets are still needed.
  • B. Decoys are premised on not being used for work. If they are used for work, legitimate use will trigger alerts.
  • C. Correct. Access to something nobody has a reason to touch is a clue with few false positives.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. The second revision (Rev. 2) of SP 800-61, the incident response guide published by the US NIST in 2012, presents incident response as a cycle of four phases. Which of the following gives the phases in the correct order?
  2. Evidence for an investigation is to be collected from a server where an incident occurred. Which of the following orders is the most appropriate according to the principle of collecting evidence in order of how easily it is lost (order of volatility)?
  3. Evidence from an incident investigation, such as a copy of a disk, is to be handled so that it can later be used in litigation or in a report to the police. Which of the following handling is the most appropriate according to the idea of chain of custody?
  4. Which of the following correctly describes the IoC (indicator of compromise) and IoA (indicator of attack) used in threat detection?
  5. Which of the following correctly describes the difference in roles between a CSIRT and a PSIRT set up within an organization?

Comparisons in this topic