Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
The goal is to configure accounts for attackers to exploit. That describes honeytoken accounts in Microsoft Defender for Identity: decoy accounts with no legitimate use, so any activity involving them (sign-in attempts, queries, etc.) raises an alert. The proposed solution is configuring the sign-in risk policy in Azure AD (Microsoft Entra) Identity Protection. That is a different feature. It evaluates how risky a sign-in looks (unfamiliar location, anonymous IP, and so on) and can require MFA or block access. It does not create decoy accounts. The correct approach In the Defender for Identity portal (security.microsoft.com), you: Go to Settings > Identities (or the Defender for Identity settings). Open Entity tags. Select Honeytoken. Tag the accounts you want to use as decoys. Defender for Identity then alerts when a honeytoken account is used or probed.
On exam, December 2025
In the exam 05-2025