A small city runs a honeynet segment that mimics SCADA HMI hosts. How does a honeynet differ from a honeypot?

A honeypot is typically a single decoy system designed to attract and observe attackers. A honeynet is a network of decoy systems—often a segmented environment—used for broader deception, research, and lateral-movement observation. A small city that runs a segment mimicking SCADA HMI hosts is operating a honeynet: multiple related decoys in a network context, not one isolated fake host and not a live production control ring.

The reversed definition—a honeynet as a single decoy and a honeypot as an entire production SCADA ring—both flips scale and dangerously confuses deception with real industrial systems. Claiming a honeynet replaces firewalls so decoys can face the internet unprotected misunderstands purpose: deception supplements monitoring and research; it does not justify removing perimeter or segmentation controls around real civic infrastructure. Claiming honeypot and honeynet are identical erases a standard scale distinction tested on SY0-701.

Exam caveat: remember scale—pot versus net—and never treat production SCADA as a honeypot. Deception environments should be isolated so attackers cannot pivot into water, power, or traffic systems.

Operational check: if the city deploys a SCADA-like honeynet, place it on a tightly controlled segment with egress monitoring, no trust path into live OT, clear legal/authorization rules for observation, and SOC playbooks for when decoys are touched. Keep real HMI and PLC networks behind proper OT security, independent of the honeynet's lessons.