Which statement about honeypots is true?

• A. They have no authorized users other than honeypot administrators.
• B. They replace intrusion detection systems.
• C. They are legal in all jurisdictions.
• D. They always serve a business function.

Answer: (A)

Honeypots are decoy systems placed in a network to attract attackers so you can observe their techniques and gather intelligence without risking real assets. A key point is that there are no legitimate users for a honeypot beyond the administrators who manage it; if someone accesses it, that access is treated as suspicious, and the data collected helps defenders understand attacker behavior without exposing genuine users or systems.

This is why the statement about having no authorized users other than honeypot administrators is the best description. Honeypots are not meant to replace other security controls, so they don’t replace intrusion detection systems; they complement them by providing concrete attacker interaction data rather than relying solely on sensors and alerts. Legality isn’t universal across jurisdictions—deployment rules and restrictions vary, so they aren’t legal everywhere. And while honeypots can be valuable, they don’t always serve a direct business function—some deployments are for research, training, or long-term security monitoring, and their usefulness depends on context and risk management.