nerdexam
GIAC

GCIH · Question #407

If virtual machines are relatively easy for an attacker to detect, the next best thing might be to put so much honey in your honeypot, attackers won't be able to resist. Which actions would result…

The correct answer is D. Install only older versions of software, remove the 'Block All' setting on the firewall, and falsify the. A honeypot generates the most meaningful attacker traffic when it appears genuinely vulnerable, using outdated software and permissive firewall rules to attract real exploitation attempts.

Incident Response & Cyber Kill Chain

Question

If virtual machines are relatively easy for an attacker to detect, the next best thing might be to put so much honey in your honeypot, attackers won't be able to resist. Which actions would result in the most meaningful traffic on your honeypot?

Options

  • AInstall the latest OS and patches, use interesting usernames and easy to guess passwords, don't
  • BSet file and folder permissions so everyone has full access, allow full directory browsing on the
  • CGive the server a tempting name, create directories and files with appealing names, and create
  • DInstall only older versions of software, remove the 'Block All' setting on the firewall, and falsify the

How the community answered

(52 responses)
  • A
    4% (2)
  • B
    10% (5)
  • C
    6% (3)
  • D
    81% (42)

Why each option

A honeypot generates the most meaningful attacker traffic when it appears genuinely vulnerable, using outdated software and permissive firewall rules to attract real exploitation attempts.

AInstall the latest OS and patches, use interesting usernames and easy to guess passwords, don't

Using the latest OS and patches eliminates the exploitable vulnerabilities that attract sophisticated attackers, making the honeypot appear too hardened to be a worthwhile target.

BSet file and folder permissions so everyone has full access, allow full directory browsing on the

Open file permissions may generate some post-compromise activity but do not address the network-level attractiveness required to draw initial attacker connections to the system.

CGive the server a tempting name, create directories and files with appealing names, and create

Appealing directory and file names can entice an attacker who is already inside, but do not create the vulnerable network-facing surface needed to attract attackers in the first place.

DInstall only older versions of software, remove the 'Block All' setting on the firewall, and falsify theCorrect

Installing older, unpatched software exposes known CVEs that attackers actively scan for and attempt to exploit, while removing restrictive firewall rules allows inbound attack traffic to reach the system unimpeded. Falsifying service banners or OS information adds credibility, making the honeypot appear to be a high-value target and maximizing realistic, analyzable attacker engagement.

Concept tested: Honeypot configuration to maximize attacker engagement

Source: https://www.sans.org/white-papers/1397/

Topics

#honeypot#deception technology#attacker luring#security monitoring

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice