Discuss Microsoft SC-100 Exam Topic 3 Question 85

Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains 500 Windows 11 devices.

You have a Microsoft 365 subscription and an Azure subscription.

You have a Microsoft Entra tenant that syncs with the domain and is linked to the subscriptions. The devices are Microsoft Entra hybrid joined.

You plan to deploy a solution to mitigate attacks against privileged accounts. The solution will include Microsoft Sentinel rules that will detect attempts to use fake cached credentials.

You need to recommend a solution to create the fake cached credentials on client computers.

What should you recommend?

AUser and Entity Behavior Analytics (UEBA) in Microsoft Sentinel

Ba deception rule in Microsoft Defender for Endpoint

Ca Honeytoken tag in Microsoft Defender for Identity

Da user risk policy in Microsoft Entra ID Protection

Suggested Answer: B

Get Premium SC-100 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Val 5 days ago

Wait, can we really rely on fake credentials to fool attackers? Sounds risky.

King 10 days ago

Totally agree, deception rules are super effective!

Angelica 15 days ago

I think option B is the best choice for creating fake cached credentials.

Hui 20 days ago

Honeytokens are clever, but I’d go with option B for this scenario.

Walker 26 days ago

UEBA is great, but it doesn't create fake credentials, right?

Dyan 1 month ago

Wait, can we really rely on fake credentials to fool attackers? Sounds risky.

Arthur 1 month ago

Totally agree, deception rules are super effective!

Brice 1 month ago

I think option B is the best choice for creating fake cached credentials.

Katie 2 months ago

I recall that deception rules in Microsoft Defender for Endpoint are meant to mislead attackers, so that might be the answer we're looking for.

Tawny 2 months ago

I practiced a similar question about detecting credential theft, and I feel like UEBA could help, but it doesn't create fake credentials, right?

Sheridan 2 months ago

I think a Honeytoken tag in Microsoft Defender for Identity might be the right choice since it deals with identity protection, but I'm not completely confident.

Truman 2 months ago

I remember studying about deception techniques, but I'm not entirely sure which option specifically creates fake cached credentials.

Microsoft SC-100 Exam - Topic 3 Question 85 Discussion