Which technique is used as a deception tactic in containment/active defense?

• A. IOC Development.
• B. Campaign identification.
• C. Malware gathering.
• D. Data decoy.

Answer: (D)

Deception in containment/active defense relies on luring the attacker with believable but harmless targets so you can observe their methods and gain time to respond. Data decoy is the technique that uses fake data, credentials, or systems (like honeytokens and decoy files) designed to look real enough to tempt an intruder. When the decoys are accessed, alerts fire and you learn what tools, techniques, or paths the attacker is using, while real assets remain protected. This approach both slows the attacker and enriches your telemetry for rapid containment and investigation.

Other options don’t fit deception-focused containment. Indicators of compromise development centers on creating signals to detect intrusions, not on misleading the attacker. Campaign identification is about attributing activity to a broader adversary operation, not about tricking or taunting the attacker. Malware gathering is the process of collecting and analyzing malicious samples, not about deceiving the adversary.