What is the primary purpose of a honeypot in security testing?

• A. Attract attackers and log their activity
• B. Block all inbound traffic
• C. Store user credentials securely
• D. Monitor internal network traffic

Answer: (A)

A honeypot is a decoy system designed to lure attackers and observe their actions in a controlled environment. Its main value lies in attracting probes and exploits to study attacker techniques, tools, and behavior, which provides insight into how to strengthen defenses and improve detection and response. By diverting attention away from real assets, it also limits risk to the actual network while gathering actionable intelligence.

Blocking all inbound traffic is what a firewall does, not a honeypot. Storing user credentials securely is about password management and authentication practices. Monitoring internal network traffic is the job of typical network monitoring or IDS/IPS, whereas a honeypot focuses on enticing attackers and logging what they do for analysis.