Exam SC-100 topic 1 question 6 discussion

Actual exam question from Microsoft's SC-100

Question #: 6
Topic #: 1

Your company has a Microsoft 365 subscription and uses Microsoft Defender for Identity.
You are informed about incidents that relate to compromised identities.
You need to recommend a solution to expose several accounts for attackers to exploit. When the attackers attempt to exploit the accounts, an alert must be triggered.
Which Defender for Identity feature should you include in the recommendation?

A. sensitivity labels
B. custom user tags
C. standalone sensors
D. honeytoken entity tags

Show Suggested Answer

Suggested Answer: D 🗳️

by prabhjot at Aug. 30, 2022, 6 p.m.

Comments

Submit Cancel

PlumpyTumbler

Highly Voted 2 years, 9 months ago

Selected Answer: D

https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide#honeytoken-activity

upvoted 11 times

...

prabhjot

Highly Voted 2 years, 9 months ago

Ans is correct as The Sensitive tag is used to identify high value assets.(user / devices / groups)Honeytoken entities are used as traps for malicious actors. Any authentication associated with these honeytoken entities triggers an alert. and Defender for Identity considers Exchange servers as high-value assets and automatically tags them as Sensitive

upvoted 8 times

...

zellck

Most Recent 8 months, 2 weeks ago

Selected Answer: D

D is the answer. https://learn.microsoft.com/en-us/defender-for-identity/entity-tags#honeytoken-tags Honeytoken entities are used as traps for malicious actors. Any authentication associated with these honeytoken entities triggers an alert.

upvoted 2 times

zellck

2 years ago

Gotten this in May 2023 exam.

upvoted 3 times

...

AJ2021

8 months, 2 weeks ago

Selected Answer: D

In MDI you can set three types of Defender for Identity entity tags: Sensitive tags, Honeytoken tags, and Exchange server tags. For this question, D is correct: Honeytoken tags

upvoted 1 times

...