SY0-501 · Question #516
Every morning, a systems administrator monitors failed login attempts on the company's log management server. The administrator notices the DBAdmin account has five failed username and/or password…
The correct answer is B. Honeypot. The scenario describes a dummy account specifically designed to attract attackers, which is the definition and purpose of a honeypot. Therefore, the systems administrator should implement a honeypot to observe and learn from attacker behavior.
Question
Every morning, a systems administrator monitors failed login attempts on the company's log management server. The administrator notices the DBAdmin account has five failed username and/or password alerts during a ten-minute window. The systems administrator determines the user account is a dummy account used to attract attackers. Which of the following techniques should the systems administrator implement?
Options
- ARole-based access control
- BHoneypot
- CRule-based access control
- DPassword cracker
How the community answered
(34 responses)- A3% (1)
- B82% (28)
- C3% (1)
- D12% (4)
Why each option
The scenario describes a dummy account specifically designed to attract attackers, which is the definition and purpose of a honeypot. Therefore, the systems administrator should implement a honeypot to observe and learn from attacker behavior.
Role-based access control (RBAC) is an authorization mechanism that assigns permissions to users based on their assigned roles within an organization, not a technique for attracting or studying attackers.
A honeypot is a security mechanism designed to intentionally attract and trap cyber attackers by mimicking a legitimate system or network resource. By setting up a dummy DBAdmin account specifically to entice attackers, the organization can observe their tactics, techniques, and procedures (TTPs) without risking actual production systems, thus gathering intelligence on threats and diverting malicious activity from critical assets.
Rule-based access control is an authorization method that grants or denies access based on a set of predefined rules, and like RBAC, it is not designed to attract or trap attackers.
A password cracker is a tool used to discover passwords, either for legitimate security auditing or malicious purposes, and is not a technique for attracting attackers to a dummy system.
Concept tested: Honeypot purpose and implementation
Source: https://csrc.nist.gov/glossary/term/Honeypot
Topics
Community Discussion
No community discussion yet for this question.