CS0-004: CompTIA Cybersecurity Analyst (CySA+)Demo

Question

A Chief Information Security Officer (CISO) reviews a threat heat map and observes a significant rise in custom scanning and enumeration activity. The CISO wants to collect as much information as possible about these activities targeting the company in order to help prioritize mitigations. Which of the following solutions would best accomplish this goal?

A Configuring a honeypot in a separate environment to gather attacker techniques
B Leveraging canary tokens on all production systems to detect valid intrusion attempts
C Subscribing to information-sharing and threat intelligence reports for the industry
D Implementing a web application firewall in front of all applications and having it log attacks

Explanation

A honeypot deployed in an isolated environment acts as a decoy system designed to attract attackers and capture detailed information about their reconnaissance methods, tools, and techniques as they scan and enumerate it. Because it is separated from production, it can safely absorb and log this custom scanning/enumeration activity without risk to real assets, giving defenders rich, actionable intelligence on the specific techniques being used against the organization — which is exactly what the CISO needs to prioritize mitigations. Canary tokens only alert on access to a decoy artifact rather than capturing broad technique data, industry threat-intel feeds provide only generic, non-company-specific information, and a WAF only logs attacks against web applications rather than general network scanning and enumeration activity.

Learn more

CS0-004: CompTIA Cybersecurity Analyst (CySA+)Demo

AstroTutor

Notes

Readiness

QuestionQ24

Community Discussion