SY0-701 Question 235

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose CE1

  C. Honeypots: These are decoy systems or services designed to attract attackers. Once an attacker interacts with a honeypot, their actions can be monitored, logged, and analyzed—making it a powerful tool for detecting intrusions and studying attacker behavior. E. DNS Sinkhole: This method redirects traffic from known malicious domains to a controlled server (the "sinkhole"). It helps detect compromised systems trying to reach command-and-control servers or download malware, revealing active threats inside the network.

• Chose CE4

  C. Honeypots and E. DNS sinkhole Explanation: Honeypots: These are decoy systems set up to lure attackers and observe their behavior once they've infiltrated the network. They help detect unauthorized activity and gather intelligence about the attack. DNS sinkhole: This redirects malicious traffic (e.g., communication with command-and-control servers) to a controlled environment, allowing detection of compromised systems within the network. Other Options: A. Tokenization: Focuses on replacing sensitive data with tokens for security but doesn’t help in detecting attackers. B. CI/CD: Refers to Continuous Integration/Continuous Deployment processes, which are unrelated to intrusion detection. D. Threat modeling: Identifies potential risks during system design but doesn’t detect attackers already in the network. F. Data obfuscation: Hides sensitive data but does not help with detecting network intrusions.

• 18

  C&E Honeypot attracts and traps attacker and DNS sinkhole redirects malicious domain name queries to a controlled server to detect and block communication between compromised host and their C2 servers.