MENU
What is the purpose of a Threat Defense for Active Directory Deceptive Account?
Suggested Answer: A
Get Premium 250-586 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The purpose of a Threat Defense for Active Directory Deceptive Account is to expose attackers as they attempt to gather credential information from workstation memory. These deceptive accounts are crafted to resemble legitimate credentials but are, in fact, traps that alert administrators to malicious activity. When an attacker attempts to access these deceptive credentials, it indicates potential unauthorized efforts to harvest credentials, allowing security teams to detect and respond to these intrusions proactively.
SES Complete Documentation explains the use of deceptive accounts as part of a proactive defense strategy, where false credentials are seeded in vulnerable areas to catch and track attacker movements within the network.
38 comments · newest first
AP
Apolonia
11 months ago
A is also a valid point, though.
YE
Yesenia
11 months ago
Wait, fake NTLM hashes? That's wild!
MI
Mitzie
11 months ago
I thought it was more about preventing access, not just exposing them.
LA
Lai
12 months ago
Totally agree, option B is spot on.
AN
Antonette
12 months ago
It's a honeypot to catch attackers!
WI
Winifred
12 months ago
I believe the main goal is to lure attackers into revealing their methods, which sounds like option B, but I could be wrong.
LI
Lilli
1 year ago
I’m a bit confused about the role of the fake NTLM hash in option D. Does it really help in defending against attacks?
XE
Xenia
1 year ago
I remember practicing a question similar to this, and I feel like option B makes the most sense as a honeypot strategy.
SC
Scot
1 year ago
I think the purpose of the Threat Defense is to expose attackers, but I'm not sure if it's more about credential gathering or mapping out the network.
UL
Ula
1 year ago
This is a good question. I'll need to think about the different ways that attackers might try to target Active Directory and see which option best describes the purpose of a Deceptive Account.
TA
Tawny
1 year ago
I'm pretty confident I know the answer to this one. A Threat Defense for Active Directory Deceptive Account is used to expose attackers who are trying to gather credential information, so I'll go with option A.
EL
Elbert
1 year ago
Okay, I think I've got this. The purpose is to act as a honeypot and expose attackers as they try to gather information about the Active Directory environment. Option B looks like the best answer.
TA
Tandra
1 year ago
Hmm, I'm a bit confused by the options here. I'll need to review my notes on Active Directory security to see if I can figure out the right answer.
ID
Idella
1 year ago
This seems like a tricky question. I'll need to think it through carefully to make sure I understand the purpose of a Threat Defense for Active Directory Deceptive Account.
RE
Rebbecca
2 years ago
Option A, all the way! Exposing those attackers is like catching a bunch of mice in a cheese factory.
IS
Isaiah
2 years ago
Option C seems like the most straightforward way to protect the Domain Admins Group. Boring, but effective!
MA
Malcolm
2 years ago
User 4: Definitely, security should always be a top priority.
RO
Rodolfo
2 years ago
User 3: I agree, it's better to be safe than sorry.
JU
Junita
2 years ago
User 2: Yeah, it's important to prevent attackers from accessing sensitive information.
MI
Mila
2 years ago
User 1: Option C seems like the most straightforward way to protect the Domain Admins Group.
MA
Marjory
2 years ago
I believe it also assigns fake NTLM password hash values to users with AdminCount attribute.
JO
Joanna
2 years ago
This is a tough one, but I'm feeling Option B. Gotta love a good 'treasure map' trap!
CO
Coletta
2 years ago
Option D is the only one that mentions NTLM hashes, so that's gotta be the right answer. Time to fake 'em out!
DO
Donte
2 years ago
D) It assigns a fake NTLM password hash value for users with an assigned AdminCount attribute.
NO
Novella
2 years ago
C) It prevents attackers from reading the contents of the Domain Admins Group
JU
Juan
2 years ago
B) It acts as a honeypot to expose attackers as they attempt build their AD treasure map
RE
Renea
2 years ago
A) It exposes attackers as they seek to gather credential information from workstation memory
VA
Valentine
2 years ago
I agree with Delpha, it acts as a honeypot to catch attackers building their AD treasure map.
DE
Delpha
2 years ago
I think the purpose is to expose attackers trying to gather credential information.
TY
Tyisha
2 years ago
I'm going with Option A. Exposing the attackers as they try to gather credentials is just too good to pass up.
BA
Barbra
2 years ago
I see your point, but I still think Option C is the best way to prevent attackers from accessing sensitive information.
ME
Mel
2 years ago
I think Option B could also be effective in luring attackers and exposing them.
KR
Kris
2 years ago
I agree, Option A sounds like a great way to catch attackers in the act.
MA
Magdalene
2 years ago
Option B sounds like the way to go. Who doesn't love a good honeypot to catch those pesky attackers?
RO
Rosalind
2 years ago
User 4: It's important to stay one step ahead of attackers, and using deceptive accounts can help in that.
LO
Lonna
2 years ago
User 3: I agree, using deceptive accounts to track and monitor malicious activity is a smart defense strategy.
GI
Gilberto
2 years ago
User 2: Yeah, honeypots can be really effective in luring attackers and exposing their tactics.
MA
Malinda
2 years ago
User 1: Option B sounds like the way to go. Who doesn't love a good honeypot to catch those pesky attackers?