EC-Council Network Defense Essentials (NDE) Practice Test

Understanding how different honeypot levels affect data collection helps you see why this level is the one that yields richer attacker information. Low-interaction honeypots mimic only a few services and log basic contact data—IP addresses, ports, and simple banners—so you see who is probing but not how they move or what tools they use. High-interaction honeypots expose a real, fully functional system, allowing attackers to perform complex actions and revealing extensive details about techniques and tools—but this comes with higher risk and more management overhead. Medium-interaction honeypots strike a middle ground. They simulate more realistic services and permit meaningful, limited user interactions. Attackers can try commands, access files, or deploy common utilities, which generates deeper telemetry than a low-interaction setup. You collect richer data: the specific techniques attempted, the tools used, command sequences, and the progression of an attack, without giving an attacker full control of a real system. This level provides enough detail to map out an attack vector comprehensively while keeping the environment safer and easier to manage than a high-interaction deployment. So, the deeper, actionable visibility into attacker behavior and tool usage that medium-interaction honeypots provide is why this choice is the best fit for capturing complete information about a given attack vector.