Question
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are configuring Microsoft Defender for Identity integration with Active Directory.
From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit.
Solution: From Azure AD Identity Protection, you configure the sign-in risk policy.
Does this meet the goal?
- A. Yes
- B. No Correct
Explanation
A sign-in risk policy in Identity Protection (now Microsoft Entra ID Protection) responds to risky sign-ins with controls such as MFA or blocking; it does not create decoy accounts and is not configured in Defender for Identity. Decoy accounts for attackers are configured as Honeytoken entity tags in Defender for Identity.
