What is the security purpose of deploying a honeypot inside an enterprise network (internal honeypot)?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — an internal honeypot is a fake system with no legitimate purpose, so any connection to it flags a misconfigured system, scanning attacker, or lateral movement. You get a high-fidelity detection mechanism for internal threats.
Full Explanation
The correct purpose is to detect internal threats and lateral movement, because an internal honeypot is a fake system with no legitimate purpose; any network connection to it indicates either a misconfigured system, a scanning attacker, or lateral movement activity — making it a high-fidelity detection mechanism. The option about attracting external internet attackers and studying their techniques is wrong because internet-facing honeypots study external attackers, while internal honeypots are designed to detect internal threats. The option about providing an alternative target for DDoS attacks to protect production systems is wrong because honeypots are low-interaction detection tools, not DDoS mitigation systems. The option about testing whether the IDS generates alerts for known attack signatures is wrong because IDS testing is done with lab environments or dedicated tools, not production honeypots.