Exam 312-49 topic 1 question 24 discussion

The placement of a honeypot on the network depends on what your purpose for placing it is. If you want to see attacks coming from the internet into your DMZ, then put it there, but that will miss attackers coming in through a client inside the network (think BEC). In all practicality, they should be placed EVERYWHERE on your network. However, I completely disagree that "it doesn't matter." It certainly DOES MATTER where you place it.

If the honeypot is in front of firewall then logical thinking it's safe but too obvious. The threat actor is not a silly guy :-). So look like D is better answer.

I say D just for the fact of; if I were a threat actor and I see an externally facing resource, I'm going to assume its a honeypot and not interact with it. If it says its a DC or something and inside were files like "important" or "top-secret" its pretty easy to deduce that this isnt worth my time infiltrating most likely and any interaction I have on pulling files would be flagged and I would immediately be identified. My best bet would be to continue enumerating and seeking out POCs for lateral movement. D just makes more sense as you could deploy externally facing honeypots and internal honeypots to catch threats inside the wire

The idea of honey pot is to learn all attack can be launched against a network externally,to get accurate result place it in front of a firewall.

As long as the intention is to honeypot some critical servers, D is correct: You will deploy a honeypot in the same datacenter as you have your SQL database. Will deploy too on the same place you have your Apache2 running, and probably you will deploy a honeypot on the same net segment you have an DC running. Cause idea is, to emulate any system you want, really does not matter where to deploy: All is fake

C should be the answer..

I support C too but I have seen it some where as D. I was suprised too

Answer shd be C