Isaca CCOA Question Answer
Which of the following can be used to identity malicious activity through a take user identity?
Honeypot
Honey account
Indicator of compromise (IoC)
Multi-factor authentication (MFA)
Ahoney accountis adecoy user accountset up to detectmalicious activity, such as:
Deception Techniques:The account appears legitimate to attackers, enticing them to use it.
Monitoring Usage:Any interaction with the honey account triggers an alert, indicating potential compromise.
Detection of Credential Theft:If attackers attempt to use the honey account, it signals possible credential leakage.
Purpose:Specifically designed toidentify malicious activitythrough themisuse of seemingly valid accounts.
Other options analysis:
A. Honeypot:A decoy system or network, not specifically an account.
C. Indicator of compromise (IoC):Represents evidence of an attack, not a decoy mechanism.
D. Multi-factor authentication (MFA):Increases authentication security, but does not detect malicious use directly.
CCOA Official Review Manual, 1st Edition References:
Chapter 6: Threat Detection and Deception:Discusses the use of honey accounts for detecting unauthorized access.
Chapter 8: Advanced Threat Intelligence:Highlights honey accounts as a proactive detection technique.
TESTED 02 Aug 2025
Copyright © 2014-2025 ACE4Sure. All Rights Reserved