Using Honey Nets to Capture Attacker TTPs
Short answer
C A honey net is used to capture tactics, techniques, and procedures of malicious threats by luring attackers into a simulated environment for observation.
Question
Key Takeaways
The trap is confusing reactive defenses like IDS/IPS with proactive deception; honey nets invite attacks to study TTPs, while IDS/IPS block or alert on them.
This N10-009 question identifies the honey net as the correct tool for capturing attacker TTPs. Learn how deception technology differs from IDS/IPS for strengthening network security posture.
Common mistake: Candidates often choose IDS or IPS because these are common security appliances. However, IDS/IPS are defensive/reactive tools focused on protection, whereas honey nets are offensive/deceptive tools focused on intelligence gathering and TTP capture.
Expert Analysis
Honey nets are designed for offensive intelligence gathering.
The question asks for a tool used to "capture tactics, techniques, and procedures (TTPs)" of malicious threats. A honey net is a decoy network that simulates vulnerable systems specifically to lure attackers. Its primary purpose is not just detection, but observation and analysis of the attacker's behavior, tools, and methods once they engage with the decoy environment.
Contrast with Defensive Controls (IDS/IPS)
While Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) monitor traffic for known signatures or anomalies, their main goal is to detect and block or alert on attacks in real-time to protect production assets. They react to threats rather than proactively inviting them to study their TTPs in depth. The suggested answer key often confuses these reactive controls with proactive deception technologies.
Jumpboxes serve access control, not threat capture.
A jumpbox (or bastion host) is a secure intermediate server used to access other systems within a network. It enhances security by limiting direct access points but does not inherently capture or analyze attacker TTPs.
Conclusion: The only option explicitly designed to attract adversaries and record their specific behaviors (TTPs) for defensive improvement is the honey net.
Exam Strategy
When questions ask about 'capturing' or 'studying' attacker behavior, look for deception technologies like honeypots or honey nets. If the question focuses on 'blocking', 'preventing', or 'monitoring' live traffic for known signatures, select IDS or IPS. Distinguish between active defense (deception) and passive/reactive defense (monitoring).
Frequently Asked Questions
What is the difference between a honeypot and a honey net?
Why not use an IDS to capture TTPs?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
ERB14 👍 1 Answered CC. Honey net: A decoy network set up to simulate vulnerable systems, specifically designed to lure attackers and safely observe their behaviours, tools, and TTPs.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All N10-009 Questions
Access 100 questions with complete answers and detailed explanations.
View Full N10-009 Practice Test →