2
Decoy environments only work if a) there’s plausible deniability for having the feature enabled, b) the contents of the decoy are realistic and c) the decoy environment has a consistent timeline of activity up to the present.
If any of those isn’t true, it just provides probable cause to dig deeper.