Systems Security Certified Practitioner – SSCP – Question0451

What is the primary goal of setting up a honeypot?

A.
To lure hackers into attacking unused systems
B. To entrap and track down possible hackers
C. To set up a sacrificial lamb on the network
D. To know when certain types of attacks are in progress and to learn about attack techniques so the network can be fortified.

Correct Answer: D

Explanation:

The primary purpose of a honeypot is to study the attack methods of an attacker for the purposes of understanding their methods and improving defenses.
“To lure hackers into attacking unused systems” is incorrect. Honeypots can serve as decoys but their primary purpose is to study the behaviors of attackers.
“To entrap and track down possible hackers” is incorrect. There are a host of legal issues around enticement vs entrapment but a good general rule is that entrapment is generally prohibited and evidence gathered in a scenario that could be considered as “entrapping” an attacker would not be admissible in a court of law.
“To set up a sacrificial lamb on the network” is incorrect. While a honeypot is a sort of sacrificial lamb and may attract attacks that might have been directed against production systems, its real purpose is to study the methods of attackers with the goals of better understanding and improving network defenses.
References AIO3, p. 213