Question 7

The security team created a honeynet

Allowing inbound SMB and RDP from the internet to a single VLAN is indicative of setting up a honeynet, which is designed to attract and analyze malicious activity in a controlled environment.

A) The company built a new file-sharing site

While building a new file-sharing site could necessitate inbound SMB traffic, it typically would not require RDP access from the internet. This option lacks the specific intent of monitoring and analyzing threats, which is central to the honeynet concept.

B) The organization is preparing for a penetration test

Preparing for a penetration test would usually involve a controlled environment with specific parameters that do not include exposing services like SMB and RDP to the internet. This option does not align with the purpose of a honeynet, which is more focused on security research and threat detection.

C) The security team is integrating with an SASE platform

Integration with a Secure Access Service Edge (SASE) platform generally emphasizes secure access and traffic management rather than exposing services like SMB and RDP to the internet. This option does not fit the rationale for creating a honeynet and is therefore incorrect.

D) The security team created a honeynet

Creating a honeynet involves intentionally exposing certain services to attract attackers, allowing the security team to study their methods and tools. This aligns perfectly with the actions described, making it the most plausible explanation for the request to allow SMB and RDP traffic.

Conclusion

The correct answer, "The security team created a honeynet," is justified as it clearly aligns with the purpose of allowing SMB and RDP access from the internet for monitoring and analyzing malicious activity. All other options fail to provide a rationale that directly supports the exposure of these services in a manner consistent with security research objectives.