What does the term "honeypot" refer to in threat hunting techniques?

Question

Options

• AA decoy system designed to lure attackers
• BA sweet treat for security analysts
• CA type of encryption algorithm
• DA tool used for network mapping

• A
  94% (63)
• B
  3% (2)
• C
  1% (1)
• D
  1% (1)

Explanation

Option A is correct because a honeypot is a deliberately exposed decoy system - appearing to be a legitimate target - designed to attract attackers so defenders can observe their tactics, techniques, and procedures (TTPs) without risking real assets. In threat hunting, honeypots generate high-fidelity alerts since any interaction with them is inherently suspicious.

Why the distractors are wrong:

• B is a joke answer with no security relevance.
• C confuses honeypot with cryptography - encryption algorithms (AES, RSA) are entirely different security primitives.
• D describes tools like Nmap or Masscan, which scan networks to discover hosts and open ports - the opposite of a passive lure.

Memory tip: Think of an actual honeypot - it's sticky and attracts insects. A security honeypot is "sticky" bait that attracts attackers and traps their activity for analysis. The "honey" draws them in; you watch what they do.

No community discussion yet for this question.