What is the purpose of a Threat Defense for Active Directory Deceptive Account?

What is the purpose of a Threat Defense for Active Directory Deceptive Account?
A . It prevents attackers from reading the contents of the Domain Admins Group.
B . It assigns a fake NTLM password hash value for users with an assigned AdminCount attribute.
C . It exposes attackers as they seek to gather credential information from workstation memory.
D . It acts as a honeypot to expose attackers as they attempt to build their AD treasure map

View Answer

Answer: D

Explanation:

The Threat Defense for Active Directory (AD) Deceptive Account feature serves as a honeypot within Active Directory, designed to lure attackers who are attempting to map out AD for valuable accounts or resources. By using deceptive accounts, this feature can expose attackers’ reconnaissance activities, such as attempts to gather credential information or access sensitive accounts. This strategy helps detect attackers early by observing interactions with fake accounts set up to appear as attractive targets.