Correct answer is (c) To randomly check suspicious traffic identified by an anomaly detection system
The best I can explain: “Shadow honeypots,” as researchers call them, share all the same characteristics of protected applications running on both the server and client side of a network and operate in conjunction with an ADS.