Which containment/active defense phrase emphasizes not tipping off the attacker?

Which containment/active defense phrase emphasizes not tipping off the attacker?

• A. Data decoy.
• B. Adversary network segmentation 'AVOID PLAYING YOUR HAND'.
• C. Full-scale host/network monitoring.
• D. Bit mangling.

Answer: (B)

Not tipping off the attacker is about keeping your defensive posture stealthy and unpredictable while you contain and study the intrusion. In containment and active defense, you want to observe how the adversary moves, what they attempt, and how they respond to your controls without revealing exactly how you’re monitoring or defending. That keeps the attacker from adjusting their tactics in ways that render your defenses useless and buys you time to respond. Framing this as adversary network segmentation and explicitly stating “avoid playing your hand” captures that idea. By segmenting the network in a way that constrains the attacker and confines their movement, you can monitor and trap behavior within controlled areas. This approach lets you gather intelligence and respond without signaling the full extent of your defenses or the precise monitoring in place, which is exactly what not tipping off the attacker aims to achieve. The other options focus more on detection, data deception, or data integrity rather than maintaining concealment. Data decoys and honeytokens are forms of deception, but they can alert the attacker to the deception or influence their behavior in predictable ways. Full-scale host/network monitoring emphasizes visibility and detection rather than stealth, and bit mangling centers on corrupting data to catch exfiltration, not on keeping defenses hidden.

Not tipping off the attacker is about keeping your defensive posture stealthy and unpredictable while you contain and study the intrusion. In containment and active defense, you want to observe how the adversary moves, what they attempt, and how they respond to your controls without revealing exactly how you’re monitoring or defending. That keeps the attacker from adjusting their tactics in ways that render your defenses useless and buys you time to respond.

Framing this as adversary network segmentation and explicitly stating “avoid playing your hand” captures that idea. By segmenting the network in a way that constrains the attacker and confines their movement, you can monitor and trap behavior within controlled areas. This approach lets you gather intelligence and respond without signaling the full extent of your defenses or the precise monitoring in place, which is exactly what not tipping off the attacker aims to achieve.

The other options focus more on detection, data deception, or data integrity rather than maintaining concealment. Data decoys and honeytokens are forms of deception, but they can alert the attacker to the deception or influence their behavior in predictable ways. Full-scale host/network monitoring emphasizes visibility and detection rather than stealth, and bit mangling centers on corrupting data to catch exfiltration, not on keeping defenses hidden.