mediumMultiple SelectObjective-mapped
APT Detection: Honeypots and Threat Intelligence Feeds
A SOC wants to improve detection of advanced persistent threats (APTs) that evade traditional signature-based tools. Which TWO approaches are most effective? (Select exactly 2.)
Quick Answer
The answer is integrating external threat intelligence feeds into the SIEM and deploying deception technology such as honeypots. These two approaches are most effective for APT detection because they target the unknown and stealthy nature of advanced persistent threats. Honeypots act as decoy systems that lure attackers, revealing their tactics, techniques, and procedures (TTPs) without risking production assets, while threat intelligence feeds provide real-time indicators of compromise (IOCs) and adversary behavior patterns that signature-based tools miss. On the CompTIA SecurityX CAS-004 exam, this question tests your understanding of proactive detection methods beyond traditional antivirus or log management—a common trap is confusing increased log storage (option B) with improved detection capability. Remember the mnemonic “HIT the APT”: Honeypots and Intelligence feeds together catch what signatures cannot.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy honeypots and deception technology
Options D and E are correct. Deploying honeypots and deception technology (D) helps detect APTs by luring attackers into revealing themselves, while integrating external threat intelligence feeds (E) enables the SIEM to detect known indicators of compromise that may evade traditional signatures. Option A reduces false positives but does not directly improve APT detection. Option B increases log retention but does not enhance detection capability. Option C adds analysts, which is not a technology-based approach and less effective for detecting APTs that bypass signatures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reduce the false positive rate of the SIEM
Why it's wrong here
Reducing false positives improves efficiency but does not detect APTs.
- ✗
Increase log retention period to 12 months
Why it's wrong here
Longer retention helps forensics but not real-time detection.
- ✗
Hire additional security analysts
Why it's wrong here
More analysts help but are not a technology solution for detection.
- ✓
Deploy honeypots and deception technology
Why this is correct
Honeypots lure attackers and reveal their presence.
- ✓
Integrate external threat intelligence feeds into the SIEM
Why this is correct
Threat intel provides IOCs for unknown threats.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CAS-005
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are effective techniques for detecting advanced persistent threats (APTs) within a network? (Select exactly 3.)
hard- A.Using signature-based intrusion detection systems (IDS) to match known attack patterns.
- ✓ B.Conducting behavioral analysis of endpoint and network activity to detect unusual patterns.
- ✓ C.Integrating threat intelligence feeds to correlate indicators of compromise (IOCs) with internal logs.
- ✓ D.Implementing anomaly-based network traffic analysis to identify deviations from baseline behavior.
- E.Deploying honeypots to attract and analyze attacker behavior.
Why B: Behavioral analysis (option B) is effective against APTs because it establishes a baseline of normal activity and flags deviations, such as unusual lateral movement or data exfiltration patterns, which APTs often exhibit. Unlike signature-based methods, behavioral analysis can detect novel or zero-day attack techniques that do not match known signatures, making it a critical component of an advanced threat detection strategy.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.