Mitigating Privileged Account Attacks with Fake Cached Credentials

Design solutions for securing privileged access
Answer Correct answer: D — Recommend a Honeytoken tag in Microsoft Defender for Identity to create fake cached credentials on client computers.

Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains 500 Windows 11 devices. You have a Microsoft 365 subscription and an Azure subscription. You have a Microsoft Entra tenant that syncs with the domain and is linked to the subscriptions. The devices are Microsoft Entra hybrid joined. You plan to deploy a solution to mitigate attacks against privileged accounts. The solution will include Microsoft Sentinel rules that will detect attempts to use fake cached credentials. You need to recommend a solution to create the fake cached credentials on client computers. What should you recommend?

  1. User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel
  2. a deception rule in Microsoft Defender for Endpoint
  3. a user risk policy in Microsoft Entra ID Protection
  4. a Honeytoken tag in Microsoft Defender for Identity Correct Answer

Community Insight

The key insight is distinguishing between endpoint deception (Defender for Endpoint) and identity-based deception (Microsoft Defender for Identity), specifically targeting cached credentials which are identity artifacts.

This question evaluates the correct method for deploying deception technology to detect credential theft. The solution involves using Honeytoken tags in Microsoft Defender for Identity to create fake cached credentials on client computers.

Many candidates incorrectly choose Microsoft Defender for Endpoint, assuming all deception capabilities reside there. However, caching of credentials is an authentication process managed by the domain controller and identity infrastructure, making Defender for Identity the appropriate tool.

Community Discussion (4 comments)

596ccca 👍 1 Selected: B
I believe B is the correct answer. The question specifically states: "create cached and fake credentials on the client computers" This points directly to Microsoft Defender for Endpoint deception capabilities, which create decoy credentials on endpoints to detect credential theft techniques such as credential dumping and lateral movement. A Honeytoken in Microsoft Defender for Identity is a decoy Active Directory account, not cached credentials placed on client devices. Honeytokens are designed to detect the use of a monitored AD account, whereas the requirement explicitly refers to fake credentials stored on workstations. Therefore: D (Honeytoken) = decoy account in Active Directory B (Decoy account in Defender for Endpoint) = fake cached credentials on client computers The key phrase is "on the client computers", which aligns with Defender for Endpoint deception rather than Defender for Identity honeytokens.
danielklein09 👍 4 Selected: D
Honeytokens in Microsoft Defender for Identity are specifically designed to create fake/decoy credentials (honeytoken accounts) that are planted on systems.
emadmf76 👍 2 Selected: D
Use a Honeytoken tag in Microsoft Defender for Identity to create fake cached credentials on client computers and detect attacker use.
Johnny937 👍 1 Selected: B
My choice is B. What are your thoughts?

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The correct recommendation is a Honeytoken tag in Microsoft Defender for Identity (MDI). MDI monitors directory services and can be configured to plant decoy accounts or 'honeytokens' within Active Directory. When these fake cached credentials are used or dumped from client computers, MDI detects the anomalous authentication attempt, signaling a potential compromise.

Why the Other Options Are Wrong

User and Entity Behavior Analytics (UEBA) is a detection engine, not a deployment tool for creating decoys. A user risk policy in Entra ID Protection reacts to detected risks but does not create fake credentials. While Microsoft Defender for Endpoint has deception features, it focuses on file system decoys; since the question specifies 'cached credentials,' which are tied to identity sync and AD DS, MDI is the precise architectural fit.

Community Comment Notes

Community consensus strongly favors option D. As one commenter noted, "Honeytokens in Microsoft Defender for Identity are specifically designed to create fake/decoy credentials." Another user clarified that while Defender for Endpoint handles deception, the context of 'cached credentials' points directly to identity monitoring tools like MDI.

Exam Strategy

When designing solutions for privileged account protection, always align the deception technology with the artifact being targeted. If the threat vector involves credential dumping or cached logons in an AD environment, prioritize identity-focused tools like Microsoft Defender for Identity over general endpoint agents.

Frequently Asked Questions

Why not use Microsoft Defender for Endpoint for fake credentials?

Defender for Endpoint creates decoy files/folders. For cached credentials, which are identity attributes synced via AD, Microsoft Defender for Identity is the specialized tool.

What is a Honeytoken tag in MDI?

It is a configuration in Microsoft Defender for Identity that allows administrators to deploy decoy accounts or credentials to detect unauthorized access attempts.

More SC-100 FAQ →

Related Analysis

Your company has a Microsoft 365 E5 subscription. The compan

S-Grade

You have 10 Azure subscriptions that contain 100 role-based

S-Grade

You have a multicloud environment that contains Azure, Amazo

A-Grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide