2.1 Honeypots and Honeynets

Question 1

How can a DNS sinkhole be used to detect infected computers on your network?

Answer 1

If certain devices on the network have been communicating with a C2 (command and control) server, a DNS sinkhole can be used to redirect all the infected devices to a safe sinkhole, thereby identifying which computers have been infected.

Question 2

What kind of attractive files will you find in a honeynet and what do they do?

Answer 2

Honeyfiles; they are bait that send an alert if the file has been accessed by an attacker.

Question 3

Can an attacker use a DNS sinkhole in a DOS attack?

Answer 3

Yes

Question 4

What device can detect hosts attempting to accessing a malicious site and redirect them to a safe DNS sinkhole?

Answer 4

NGFW or IPS