nerdexam
CompTIA

SY0-501 · Question #516

Every morning, a systems administrator monitors failed login attempts on the company's log management server. The administrator notices the DBAdmin account has five failed username and/or password…

The correct answer is B. Honeypot. The scenario describes a dummy account specifically designed to attract attackers, which is the definition and purpose of a honeypot. Therefore, the systems administrator should implement a honeypot to observe and learn from attacker behavior.

Submitted by akirajp· Mar 4, 2026Security operations

Question

Every morning, a systems administrator monitors failed login attempts on the company's log management server. The administrator notices the DBAdmin account has five failed username and/or password alerts during a ten-minute window. The systems administrator determines the user account is a dummy account used to attract attackers. Which of the following techniques should the systems administrator implement?

Options

  • ARole-based access control
  • BHoneypot
  • CRule-based access control
  • DPassword cracker

How the community answered

(34 responses)
  • A
    3% (1)
  • B
    82% (28)
  • C
    3% (1)
  • D
    12% (4)

Why each option

The scenario describes a dummy account specifically designed to attract attackers, which is the definition and purpose of a honeypot. Therefore, the systems administrator should implement a honeypot to observe and learn from attacker behavior.

ARole-based access control

Role-based access control (RBAC) is an authorization mechanism that assigns permissions to users based on their assigned roles within an organization, not a technique for attracting or studying attackers.

BHoneypotCorrect

A honeypot is a security mechanism designed to intentionally attract and trap cyber attackers by mimicking a legitimate system or network resource. By setting up a dummy DBAdmin account specifically to entice attackers, the organization can observe their tactics, techniques, and procedures (TTPs) without risking actual production systems, thus gathering intelligence on threats and diverting malicious activity from critical assets.

CRule-based access control

Rule-based access control is an authorization method that grants or denies access based on a set of predefined rules, and like RBAC, it is not designed to attract or trap attackers.

DPassword cracker

A password cracker is a tool used to discover passwords, either for legitimate security auditing or malicious purposes, and is not a technique for attracting attackers to a dummy system.

Concept tested: Honeypot purpose and implementation

Source: https://csrc.nist.gov/glossary/term/Honeypot

Topics

#honeypot#deception technology#intrusion detection#dummy accounts

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice