AB-650 Practice Question 3147
Exam: AB-650
Domain: Govern and secure Microsoft 365 tenants and workloads
Difficulty: hard
In Microsoft Defender for Identity, what is the purpose of configuring "Honeypot" user accounts?
Answer Options
A
To detect unauthorized reconnaissance and lateral movement using decoys
B
To store user passwords in clear text for fast recovery
C
To reduce the physical storage size of the NTDS.dit database
D
To bypass MFA for executive staff
Correct Answer
A: To detect unauthorized reconnaissance and lateral movement using decoys
Explanation
Honeypots are decoy accounts with no business purpose; any authentication attempt or LDAP enumeration against them triggers high-confidence lateral movement alerts.