Mitigating Privileged Account Attacks with Fake Cached Credentials
Short answer
D Recommend a Honeytoken tag in Microsoft Defender for Identity to create fake cached credentials on client computers.
Question
You have a Microsoft 365 subscription and an Azure subscription.
You have a Microsoft Entra tenant that syncs with the domain and is linked to the subscriptions. The devices are Microsoft Entra hybrid joined.
You plan to deploy a solution to mitigate attacks against privileged accounts. The solution will include Microsoft Sentinel rules that will detect attempts to use fake cached credentials.
You need to recommend a solution to create the fake cached credentials on client computers.
What should you recommend?
Key Takeaways
The key insight is distinguishing between endpoint deception (Defender for Endpoint) and identity-based deception (Microsoft Defender for Identity), specifically targeting cached credentials which are identity artifacts.
This question evaluates the correct method for deploying deception technology to detect credential theft. The solution involves using Honeytoken tags in Microsoft Defender for Identity to create fake cached credentials on client computers.
Common mistake: Many candidates incorrectly choose Microsoft Defender for Endpoint, assuming all deception capabilities reside there. However, caching of credentials is an authentication process managed by the domain controller and identity infrastructure, making Defender for Identity the appropriate tool.
Expert Analysis
Why the Answer Is Correct
The correct recommendation is a Honeytoken tag in Microsoft Defender for Identity (MDI). MDI monitors directory services and can be configured to plant decoy accounts or 'honeytokens' within Active Directory. When these fake cached credentials are used or dumped from client computers, MDI detects the anomalous authentication attempt, signaling a potential compromise.
Why the Other Options Are Wrong
User and Entity Behavior Analytics (UEBA) is a detection engine, not a deployment tool for creating decoys. A user risk policy in Entra ID Protection reacts to detected risks but does not create fake credentials. While Microsoft Defender for Endpoint has deception features, it focuses on file system decoys; since the question specifies 'cached credentials,' which are tied to identity sync and AD DS, MDI is the precise architectural fit.
Community Comment Notes
Community consensus strongly favors option D. As one commenter noted, "Honeytokens in Microsoft Defender for Identity are specifically designed to create fake/decoy credentials." Another user clarified that while Defender for Endpoint handles deception, the context of 'cached credentials' points directly to identity monitoring tools like MDI.
Exam Strategy
When designing solutions for privileged account protection, always align the deception technology with the artifact being targeted. If the threat vector involves credential dumping or cached logons in an AD environment, prioritize identity-focused tools like Microsoft Defender for Identity over general endpoint agents.
Frequently Asked Questions
Why not use Microsoft Defender for Endpoint for fake credentials?
What is a Honeytoken tag in MDI?
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
danielklein09 👍 4 Answered DHoneytokens in Microsoft Defender for Identity are specifically designed to create fake/decoy credentials (honeytoken accounts) that are planted on systems.
-
emadmf76 👍 2 Answered DUse a Honeytoken tag in Microsoft Defender for Identity to create fake cached credentials on client computers and detect attacker use.
-
596ccca 👍 1 Answered BI believe B is the correct answer. The question specifically states: "create cached and fake credentials on the client computers" This points directly to Microsoft Defender for Endpoint deception capabilities, which create decoy credentials on endpoints to detect credential theft techniques such as credential dumping and lateral movement. A Honeytoken in Microsoft Defender for Identity is a decoy Active Directory account, not cached credentials placed on client devices. Honeytokens are designed to detect the use of a monitored AD account, whereas the requirement explicitly refers to fake credentials stored on workstations. Therefore: D (Honeytoken) = decoy account in Active Directory B (Decoy account in Defender for Endpoint) = fake cached credentials on client computers The key phrase is "on the client computers", which aligns with Defender for Endpoint deception rather than Defender for Identity honeytokens.
-
Johnny937 👍 1 Answered BMy choice is B. What are your thoughts?
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-100 Questions
Access 110 questions with complete answers and detailed explanations.
View Full SC-100 Practice Test →