Honeypot

A honeypot is a decoy system deployed to attract attackers and study them. It imitates a production asset (an exposed server, a database, a set of credentials) but holds no real data and serves no business function, so any interaction with it is suspicious by definition. That gives defenders a high-signal alarm with almost no false positives, plus a safe window in which to observe attacker tools and techniques. Multiple honeypots networked together form a honeynet, simulating a whole environment.

The legal nuance the exam cares about is enticement versus entrapment. Enticement leaves an attractive target visible to someone already looking to attack, and is legal; entrapment induces a person to commit a crime they were not otherwise intending to commit, and is not a defensible practice. A honeypot must also never contain production data: it is expected to be compromised, so anything real placed on it is deliberately handed to the attacker.

Exam relevance: if a scenario mentions a decoy, learning attacker methods, or an alert from a system nobody should ever touch, the answer is honeypot. The enticement versus entrapment distinction is a favourite trap: enticement is the acceptable one. Contrast the honeypot with sandboxing, which isolates untrusted code you already have, and with an IDS, which monitors real production traffic rather than baiting a fake target.