Exam 70-744 All Questions

View all questions & answers for the 70-744 exam

Exam 70-744 topic 1 question 40 discussion

Actual exam question from Microsoft's 70-744

Question #: 40
Topic #: 1

Your network contains an Active Directory domain named contoso.com.
You are deploying Microsoft Advanced Threat Analytics (ATA).
You create a user named User1.
You need to configure the user account of User1 as a Honeytoken account.
Which information must you use to configure the Honeytoken account?

A. The SAM account name of User1
B. The Globally Unique Identifier (GUID) of User1
C. the SID of User1
D. the UPN of User1

Show Suggested Answer

Suggested Answer: C 🗳️
References:
https://docs.microsoft.com/en-us/advanced-threat-analytics/deploy-use/working-with-detection-settings

by thomasemr at Aug. 27, 2019, 5:20 p.m.

Comments

Submit Cancel

KidCastaldo

Highly Voted 4 years, 9 months ago

ATA has been through about a dozen version revisions in the last 5 years. Currently document state that "Username" is required. (note "Username" is not the same as "SAM account name" so technically there is no correct answer according to current Microsoft documents) However, earlier versions of ATA, (most likely at the time of the writing of this question for the exam), ATA required the SID. So for the purposes of this question, SID is most likely the right answer.

upvoted 9 times

...

SamsOtro

Most Recent 4 years, 8 months ago

Seeing indications that both SAM account name and SID work, but would go with SID. Seems that during config you can query using the SAM account name - as a sort of assist - result being that you choose an account and its SID is used after you've done that.

upvoted 2 times

...

LeonSKanady

4 years, 11 months ago

From the link below , it seems SID is not longer being used for honeytoken. Now only the "User Name" is needed. https://docs.microsoft.com/en-us/advanced-threat-analytics/install-ata-step7

upvoted 3 times

...

Kamikazekiller

5 years ago

Answer is correct. C. the SID of User1

upvoted 3 times

...

TIm0101010

5 years ago

https://docs.microsoft.com/en-us/advanced-threat-analytics/ata-prerequisites Optional: A user account of a user with no network activities. This account is configurable as an ATA Honeytoken user. To configure an account as a Honeytoken user, only the username is required. For Honeytoken configuration information, see Configure IP address exclusions and Honeytoken user.

upvoted 2 times

...

MDol

5 years, 3 months ago

The answer is: A https://docs.microsoft.com/en-us/advanced-threat-analytics/install-ata-step7

upvoted 1 times

...

Ario

5 years, 4 months ago

To configure the Honeytoken user you need the SID of the user account, not the username so C is correct answer

upvoted 1 times

...

Pleumatum

5 years, 6 months ago

its A justed checked it in my ATA

upvoted 2 times

...

itguru

5 years, 8 months ago

Wrong it is not SID. On this you can see that it is account name: https://docs.microsoft.com/en-us/advanced-threat-analytics/install-ata-step7

upvoted 2 times

ArchBishop

5 years, 8 months ago

Huh... you're right too.. HOWEVER, I found this about the SAM Account Name: https://docs.microsoft.com/en-us/windows/win32/ad/naming-properties?redirectedfrom=MSDN#samaccountname https://docs.microsoft.com/en-us/advanced-threat-analytics/ata-prerequisites ATA requires 2003 FFL or higher. SAM Account Names are indicative support for older than Windows 2000. UPN is the newer standard for User Account Names. So A would be incorrect; with the only other option, the SID.. based on the video from above.

upvoted 1 times

ArchBishop

5 years, 8 months ago

Disregard, I see the UPN as an option below.

upvoted 1 times

...

thomasemr

5 years, 11 months ago

https://www.youtube.com/watch?v=5Hw7L51cmGY

upvoted 2 times

ArchBishop

5 years, 9 months ago

It's in Spanish, but at 40 Seconds in, you can clearly see that the SID is, indeed, the required Identifier that is required for the config

upvoted 4 times

...