Deception and disruption technology sits in objective 1.2, and the vocabulary is genuinely small. Four terms. Most people memorize all four in about ten minutes and then still miss the question, because these stems are aimed somewhere else. They want the job the thing is doing.
The four terms sort themselves by size
So what is being faked here?
A honeytoken is a fake piece of data. A credential nobody was ever issued. An email address no human uses. A customer record with no customer behind it.
Move up a rung and a honeyfile is a fake file. The stock example is something named passwords.txt, sitting in a share where it looks worth opening.
A honeypot is a fake system, a server that looks like part of your environment without being part of it.
Biggest of the four, a honeynet is a fake network. Several honeypots plus the supporting cast. Workstations and routers and a firewall, enough of an environment that it holds up when somebody starts poking around in it.
Token, file, system, network. Exam stems almost always describe the fake thing directly, so most of these questions come down to matching that description to the right rung on the ladder.
The pair that actually gets missed
Honeyfile and honeytoken are worth slowing down on. Both are bait and both are small, so the answer choices lean on them hard.
A honeyfile is an alarm. It sits inside your environment, and the whole value is that nobody has a legitimate reason to open it. Somebody opens it and you have a detection. You have it early, too.
The honeytoken works as a tracer instead. Its value shows up after the data has left you. You seed a fake credential or a fake record, and when it surfaces somewhere it should not be, in a dump or inside another company's system, you know which copy walked out and usually where it walked out of.
So what is the scenario actually asking for? An alarm inside the building, or a way to follow something that already left. That single split resolves most of them.
Why the family works at all
Here is the part CompTIA cares about, and the part people skip on their way to memorizing four words.
Detection normally has a false positive problem. A rule that alerts on failed logins also alerts on the guy who forgot his password after vacation. Every real detection you write has to be tuned against normal behavior, and tuning is exactly where real alerts get buried.
A honeypot has no normal behavior to tune against. Nobody has a business reason to authenticate to a server that serves nothing, or to open a file that no process ever references. Legitimate use is zero. Interaction is the signal, full stop.
That is why the deception answer wins when a stem describes a team buried in alerts and asks what would give them a high-confidence indicator.
What it is not
Nothing in this family prevents anything, and this is where the trap answers live. When the stem asks how to stop the intrusion, or how to keep somebody off the file server, every deception option in the list is wrong no matter how good it sounds.
What deception does is detect, and buy time. A scanner that burns its whole run enumerating an environment you invented is not spending that run on the real one. That is the disruption half of the objective title, though detection is what you actually deploy it for.
Reading the stem
Two questions, in this order.
What is the fake thing? Is it data? A file? A system, or a whole environment? That picks your term.
Do you want an alarm or a tracer? That splits honeyfile from honeytoken when both are sitting in the options.
There is a third habit worth building, and it carries well past this objective. When you see a control in an answer choice, ask what it produces. A honeypot produces an alert with almost no noise attached. A honeytoken produces attribution later. A firewall produces a block. Once you are reading controls by what comes out of them, four technically-true answers stop looking so similar, which is most of what this exam is.
I write practice questions for this objective over at SecPlus Mastery, and the deception ones are some of the easiest questions to write badly. It is very tempting to put a honeypot next to three controls nobody would ever pick. The real exam does not do that. It gives you four things a real company genuinely does, and the deception option is right or wrong depending on one word in the stem, usually detect or prevent.
If you have not measured where you stand on Domain 1 yet, the free diagnostic breaks your result out by objective, which tells you more than a single percentage when you are deciding what to study next.
One last thing about honeypots specifically. Anything you deploy has to be isolated from the real environment. A decoy that shares credentials or sits flat on the production network hands an attacker a foothold, which is worth remembering on the exam for the same reason it is worth remembering on the job.
Top comments (0)