A security research team wants to lure attackers into a convincing environment of several interconnected decoy servers and workstations so it can observe how they move laterally from one system to another. Which deception technology fits this goal?
Select an answer to reveal the explanation.
Short Explanation
One fake house is a honeypot; a whole fake neighborhood with streets between the houses is a honeynet. If you want to watch attackers move from system to system, you need more than one system to move between. That's the detail that settles it.
Full Explanation
A honeynet is a network of multiple decoy systems, often with realistic services, accounts and traffic, built to attract attackers and record what they do. Because it contains several interconnected hosts, it lets defenders observe reconnaissance, credential use and lateral movement across systems, which is exactly the behavior the research team wants to study. A honeypot is a single decoy system; it can reveal initial exploitation and tools, but with only one host there is no internal network for the attacker to move through, so lateral movement cannot be observed. A honeyfile is a decoy document placed on a real or fake file share that alerts when it is opened, providing a detection tripwire rather than an environment to study attacker progression. A honeytoken is a decoy credential, record or other data element whose use signals compromise; like the honeyfile, it detects activity but does not host the attacker in a place where their movement can be watched. Exam caveat: deception environments must be isolated from production and monitored closely so that attackers cannot use them as a launch point against real systems. Operational check: verify the honeynet has no routes into production, confirm every host forwards logs and traffic captures to a separate collector, and confirm alerts fire when any decoy is touched.