Which of the following can Joe, a security administrator, implement on his network to capture attack
details that are occurring while also protecting his production network?
A.
Security logs
B.
Protocol analyzer
C.
Audit logs
D.
Honeypot
Explanation:
A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study the
attack to research current attack methodologies.
According to the Wepopedia.com, a Honeypot luring a hacker into a system has several main purposes:
The administrator can watch the hacker exploit the vulnerabilities of the system, thereby learning where
the system has weaknesses that need to be redesigned.
The hacker can be caught and stopped while trying to obtain root access to the system.
By studying the activities of hackers, designers can better create more secure systems that are potentially
invulnerable to future hackers.There are two main types of honeypots:
Production – A production honeypot is one used within an organization’s environment to help mitigate
risk.
Research – A research honeypot add value to research in computer security by providing a platform to
study the threat.
Incorrect Answers:
A: Security logs record security events such as logon and logoff events. Security logs can be used to
monitor failed logon events which could indicate an attack. However, logon attempts are just one form of
attack. A honeypot can be used to monitor all sorts of attack. Therefore, a honeypot is a better answer so
this answer is incorrect.
B: A Protocol Analyzer is a hardware device or more commonly a software program used to capture
network data communications sent between devices on a network. It would be difficult to monitor
attacks by analyzing network communications. Therefore, a honeypot is a better answer so this answer is
incorrect.
C: Audit logs record events such as file access (successful or unsuccessful) or Active Directory
modifications. Audit logs could be used monitor failed attempts to access files which could indicate an
attack. However, file access attempts are just one form of attack. A honeypot can be used to monitor all
sorts of attack. Therefore, a honeypot is a better answer so this answer is incorrect.https://ethics.csc.ncsu.edu/abuse/hacking/honeypots/study.php