ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam 70-744 All Questions

View all questions & answers for the 70-744 exam
Go to Exam

Exam 70-744 topic 1 question 40 discussion

Actual exam question from Microsoft's 70-744
Question #: 40
Topic #: 1
[All 70-744 Questions]

Your network contains an Active Directory domain named contoso.com.
You are deploying Microsoft Advanced Threat Analytics (ATA).
You create a user named User1.
You need to configure the user account of User1 as a Honeytoken account.
Which information must you use to configure the Honeytoken account?

  • A. The SAM account name of User1
  • B. The Globally Unique Identifier (GUID) of User1
  • C. the SID of User1
  • D. the UPN of User1
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️
References:
https://docs.microsoft.com/en-us/advanced-threat-analytics/deploy-use/working-with-detection-settings
by thomasemr at Aug. 27, 2019, 5:20 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
KidCastaldo
Highly Voted 4 years, 6 months ago
ATA has been through about a dozen version revisions in the last 5 years. Currently document state that "Username" is required. (note "Username" is not the same as "SAM account name" so technically there is no correct answer according to current Microsoft documents) However, earlier versions of ATA, (most likely at the time of the writing of this question for the exam), ATA required the SID. So for the purposes of this question, SID is most likely the right answer.
upvoted 9 times
...
SamsOtro
Most Recent 4 years, 5 months ago
Seeing indications that both SAM account name and SID work, but would go with SID. Seems that during config you can query using the SAM account name - as a sort of assist - result being that you choose an account and its SID is used after you've done that.
upvoted 2 times
...
LeonSKanady
4 years, 8 months ago
From the link below , it seems SID is not longer being used for honeytoken. Now only the "User Name" is needed. https://docs.microsoft.com/en-us/advanced-threat-analytics/install-ata-step7
upvoted 3 times
...
Kamikazekiller
4 years, 9 months ago
Answer is correct. C. the SID of User1
upvoted 3 times
...
TIm0101010
4 years, 9 months ago
https://docs.microsoft.com/en-us/advanced-threat-analytics/ata-prerequisites Optional: A user account of a user with no network activities. This account is configurable as an ATA Honeytoken user. To configure an account as a Honeytoken user, only the username is required. For Honeytoken configuration information, see Configure IP address exclusions and Honeytoken user.
upvoted 2 times
...
MDol
5 years ago
The answer is: A https://docs.microsoft.com/en-us/advanced-threat-analytics/install-ata-step7
upvoted 1 times
...
Ario
5 years, 1 month ago
To configure the Honeytoken user you need the SID of the user account, not the username so C is correct answer
upvoted 1 times
...
Pleumatum
5 years, 3 months ago
its A justed checked it in my ATA
upvoted 2 times
...
itguru
5 years, 5 months ago
Wrong it is not SID. On this you can see that it is account name: https://docs.microsoft.com/en-us/advanced-threat-analytics/install-ata-step7
upvoted 2 times
ArchBishop
5 years, 5 months ago
Huh... you're right too.. HOWEVER, I found this about the SAM Account Name: https://docs.microsoft.com/en-us/windows/win32/ad/naming-properties?redirectedfrom=MSDN#samaccountname https://docs.microsoft.com/en-us/advanced-threat-analytics/ata-prerequisites ATA requires 2003 FFL or higher. SAM Account Names are indicative support for older than Windows 2000. UPN is the newer standard for User Account Names. So A would be incorrect; with the only other option, the SID.. based on the video from above.
upvoted 1 times
ArchBishop
5 years, 5 months ago
Disregard, I see the UPN as an option below.
upvoted 1 times
...
...
...
thomasemr
5 years, 8 months ago
https://www.youtube.com/watch?v=5Hw7L51cmGY
upvoted 2 times
ArchBishop
5 years, 6 months ago
It's in Spanish, but at 40 Seconds in, you can clearly see that the SID is, indeed, the required Identifier that is required for the config
upvoted 4 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago