SC-200 Certification Practice Question #204

Question

You have a Microsoft 365 E5 subscription.

You need to ensure that an alert is generated in Microsoft Defender XDR when attackers attempt to connect to a specific device. The solution must minimize administrative effort.

What should you do in the Microsoft Defender portal?

Accepted Answer

Tagging an *existing* device as a **honeytoken** is the lowest-effort way to get an alert when an attacker tries to connect to that specific device. A honeytoken entity is expected to be dormant, so Defender for Identity raises a Honeytoken Activity alert on any authentication/connection attempt against it — exactly the requirement, with a single tag and no rule authoring. Deception rules with a decoy (A) or lure (C) require the Deception feature to be enabled and decoy hosts/accounts and lures to be planted across devices, which is more administrative effort and is aimed at luring attackers across the environment rather than monitoring one known device. Tagging the device as *sensitive* (D) only raises the sensitivity weighting for certain detections; it does not generate an alert simply because something connects to the device.

More SC-200 practice questions