Which of the following can Joe, a security administrator, implement on his network to capture attack details that are occurring while also protecting his production network?

Security logs record events that have already occurred on production systems but do not actively attract attackers or protect the production network from live attacks.

A protocol analyzer (packet sniffer) passively captures network traffic for analysis but does not draw attackers away from production systems or actively capture attack behavior in a controlled environment.

Audit logs track user and system activity for compliance and forensic review after the fact but do not lure attackers or provide real-time attack detail capture in isolation.

A honeypot is a purposely vulnerable decoy system designed to attract attackers, record their tools, techniques, and procedures in real time, and contain the attack away from production systems. It serves dual purposes: intelligence gathering on current attack methods and isolation of malicious activity from legitimate assets.