Attackers craft malicious probe packets and scan for services such as HTTP over SSL (HTTPS), SMTP over SSL (SMPTS) and IMAP over SSL (IMAPS) to detect honeypots in a network. Which of the following condition shows the presence of a honeypot?
a. Ports show a particular service running but deny a three-way handshake connection
b. Ports show a particular service running and allow a three-way handshake connection
c. Ports do not show any particular service running
d. Scan shows that no scanned port is live on the network

Honeypot shows any attempt of unauthorized access to information in the system. Scan showing not scanned port is live on the network shows the presence of honeypot so that hackers could be trapped to be believed that there are no scanned port.

Answer Link

Tundexi Tundexi · Answer 2 · 2022-04-01T12:08:14+02:00

The Ports that show a particular service running but deny a three-way handshake connection shows he presence of a honeypot.

What is honeypot used for?

Its provides an increased visibility and allows the IT security teams to defend against attacks that the firewall fails to prevent.

Hence, the statement that states the Ports show a particular service running but deny a three-way handshake connection is a correct statement about the presence of a honeypot.

Therefore, the Option A is correct