A security team places one decoy host on a lab network. It holds no real data and exists to log whoever attacks it. Which control is that host?
Select an answer to reveal the explanation.
Short Explanation
You leave a fake wallet on the sidewalk and watch who picks it up. The wallet is empty and the point is the log, so that single decoy is a honeypot. A whole street of decoys, a public-server zone, and the sensor that watches the real network are different tools.
Full Explanation
A honeypot is a decoy system meant to be attacked so the team can log the behavior. It holds no real production data. One such host on the lab network matches that definition. A honeynet is a network of decoy systems, not the name for a single host. A screened subnet is a firewall zone, often for public servers that are real services. It is not a decoy with no data. A production intrusion-detection sensor watches real traffic and alerts. It is not itself the decoy, and the stem says the host holds no real data. Exam caveat: a honeypot must be isolated so a compromise of the decoy cannot pivot into the lab's real systems. Operational check: confirm the decoy has no path to production data, generate a test probe, and confirm the probe appears in the honeypot log. Confirm the decoy has no route to real data, then generate a test probe and find it in the log. Put the decoy on a segment that cannot route to patient or payment systems.