Which information must you use to configure the Honeytoken account?

Your network contains an Active Directory domain named contoso.com. You are deploying Microsoft Advanced Threat Analytics (ATA). You create a user named User1. You need to configure the user account of User1 as a Honeytoken account.

Which information must you use to configure the Honeytoken account?
A . the SAM account name of User1
B . the Globally Unique Identifier (GUID) of User1
C . the SID of User1
D . the UPN of User1

View Answer

Answer: C

Explanation:

https://docs.microsoft.com/en-us/advanced-threat-analytics/ata-prerequisitesA user account of a user who has no network activities. This account is configured as the ATA Honeytoken user. To configure the Honeytoken user you need the SID of the user account, not the username.

https://docs.microsoft.com/en-us/advanced-threat-analytics/install-ata-step7ATA also enables the configuration of a Honeytoken user, which is used as a trap for malicious actors C anyauthentication associated with this (normally dormant) account will trigger an alert.