CSA (312-39) SOC Simulation Lab

Master active defense strategies. In this simulation, you will analyze SIEM alerts originating from specialized deception infrastructure designed to identify lateral movement and compromised internal hosts.

Scenario Context

OmniHealth Systems has been struggling with "low and slow" intrusions that bypass perimeter firewalls and evade standard EDR behavioral rules. Alert fatigue in the SOC is high due to noisy IDS signatures on the internal network.

As a Senior SOC Analyst, you deploy an "Active Defense" strategy. You place a fake, highly vulnerable HR Database server on a restricted subnet, loaded with fake employee data. Any interaction with this server immediately triggers a P1 alert.

Security Environment

At 07:42 UTC, your SIEM triggers a high-severity alert. You review the raw log data forwarded from the deception sensor:

[SOC Ops] SIEM Alert: High-Fidelity Deception Triggered ======================================================== Timestamp: 2026-04-08T07:42:11Z Index: idx_deception_logs Sensor Type: Cowrie (SSH/Telnet Decoy) Decoy IP: 10.99.99.100 (Fake HR DB Server) Event Data: { "eventid": "cowrie.login.success", "src_ip": "10.15.4.22", "src_port": 54192, "dst_port": 22, "username": "root", "password": "password123", "session": "9a8b7c6d", "message": "login attempt [root/password123] succeeded", "input": "cat /etc/shadow" } [Analyst Context]: - IP 10.15.4.22 is a valid Windows workstation in the Billing Dept. - The subnet 10.99.x.x contains NO legitimate production applications. ======================================================== Required Action: Determine the classification of the deployed technology.

Question

Which of the following security technology is used to attract and trap people who attempt unauthorized or illicit utilization of the host system?

SOC Hint: Think about passive vs. active defense. Firewalls and IDSs try to block or detect bad behavior on real assets. Which technology is specifically designed as "bait" to lure the attacker away from the real assets?

Expert Insight

What is happening?

An internal workstation (10.15.4.22) has been compromised and is performing lateral movement. The attacker found the fake HR Database server (10.99.99.100) and attempted to SSH into it using default credentials, subsequently trying to dump password hashes (cat /etc/shadow). Because this server is a deception tool, the SOC is instantly alerted to the compromised billing machine without having to filter through false positives.

Why C is correct

Honeypots are systems explicitly set up to act as decoys. Their sole purpose is to attract, trap, and monitor malicious activity. By looking vulnerable (e.g., open SSH, unpatched services), they bait attackers. Since no legitimate user has any business connecting to a honeypot, any interaction with it is treated as inherently hostile.

Why the other options are wrong

A. DMZ: A network segment for external-facing services (like web servers). It isolates risk but does not actively "attract" or "trap" attackers.

B. Firewall: A preventative boundary device that blocks or allows traffic based on rule sets. It rejects unauthorized use; it doesn't attract it.

D. IDS (Intrusion Detection System): A passive monitoring tool that analyzes traffic for signatures or anomalies. While it detects bad behavior, it does not act as bait.

MINI LESSON: High-Fidelity Alerting via Deception

Alert fatigue is the number one cause of missed breaches in a SOC. Deception technology (Honeypots, Honeytokens, Honeyaccounts) provides a brilliant solution to this problem:

Zero False Positives: If an IDS alerts on a failed login, it might just be a user forgetting their password. If an alert fires for a login attempt on a hidden Honeypot, you know with 100% certainty it is an anomaly (malware, a curious insider, or an attacker).
Wasting Attacker Time: The time an adversary spends enumerating and trying to exploit your honeypot is time they aren't spending on your real Domain Controller. This gives your IR team a crucial window to contain the threat.
Intelligence Gathering: Honeypots safely capture the attacker's tools, TTPs (Tactics, Techniques, and Procedures), and infrastructure (C2 IPs) for Threat Intel analysis.

Ready to validate more SOC engineering and operational concepts?

Explore more CSA simulations