Where is a honeypot best placed on a network according to recommended practice?

Where is a honeypot best placed on a network according to recommended practice?

• A. Use a system with dynamic addressing
• B. Use a system that is not directly interfacing with the router
• C. Use it on a system in an external DMZ in front of the firewall
• D. It doesn't matter as all replies are faked

Answer: (D)

Honeypots are meant to attract attackers and capture their actions while keeping production networks safe, so placement that exposes the honeypot to external traffic yet keeps the real assets isolated is key. The best practice is to put the honeypot in an external DMZ in front of the firewall. This makes the honeypot accessible to untrusted traffic, allowing you to observe attacker techniques and collect logs, while the internal network remains protected behind the firewall. It also helps contain any compromise to the DMZ and prevents attackers from reaching legitimate systems. Dynamic addressing isn’t ideal because you want stable, trackable IPs for logging and correlation. A system that isn’t directly interfacing with the router reduces exposure and makes it harder to observe external interactions. The notion that placement doesn’t matter because all replies are faked is a misunderstanding; where the honeypot sits determines what traffic you capture and how you manage risk, so placement does matter.

Honeypots are meant to attract attackers and capture their actions while keeping production networks safe, so placement that exposes the honeypot to external traffic yet keeps the real assets isolated is key. The best practice is to put the honeypot in an external DMZ in front of the firewall. This makes the honeypot accessible to untrusted traffic, allowing you to observe attacker techniques and collect logs, while the internal network remains protected behind the firewall. It also helps contain any compromise to the DMZ and prevents attackers from reaching legitimate systems.

Dynamic addressing isn’t ideal because you want stable, trackable IPs for logging and correlation. A system that isn’t directly interfacing with the router reduces exposure and makes it harder to observe external interactions. The notion that placement doesn’t matter because all replies are faked is a misunderstanding; where the honeypot sits determines what traffic you capture and how you manage risk, so placement does matter.