SC-200 Practice Question 3789
Exam: SC-200
Domain: Respond to security incidents
Difficulty: medium
In Microsoft Defender for Identity, what detection indicates that an attacker has queried a Domain Controller to extract Active Directory account properties and honeypot objects?
Answer Options
A
Reconnaissance alerts (e.g., Directory Services or LDAP queries)
B
Denial of Service alerts
C
Hardware failure alerts
D
Printer toner low alerts
Correct Answer
A: Reconnaissance alerts (e.g., Directory Services or LDAP queries)
Explanation
Reconnaissance alerts (such as "Account and group membership reconnaissance using Directory Services queries" or "LDAP search") flag automated enumeration activity.