mediumMultiple ChoiceObjective-mapped
MS-102 Practice Question: A company uses Microsoft Entra ID with password…
A company uses Microsoft Entra ID with password hash synchronization. The security team wants to prevent users from setting passwords that include their username or common terms from a custom dictionary (e.g., company name, product names). Which feature should be configured?
⚠ Common exam trap
Many exam-takers confuse password policies (which are set in on-premises AD and cannot be synced to Azure AD) with password protection features (which are configured directly in Microsoft Entra ID), leading them to incorrectly select Option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a custom banned passwords list in Microsoft Entra ID Password Protection.
Microsoft Entra ID Password Protection allows administrators to enforce custom banned password lists that prevent users from including specific terms (e.g., company name, product names) or their username in passwords. This feature works with password hash synchronization to block weak passwords at the cloud level, directly addressing the security team's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Azure AD Identity Protection with user risk policies.
Why it's wrong here
Azure AD Identity Protection's user risk policies are not a password strength mechanism; they evaluate sign-in and user risk signals to trigger conditional access actions such as requiring MFA or a password reset. While a risky-user policy can force a password change, it never inspects or constrains the characters, length, or banned words used in the new password, so it cannot satisfy a requirement to prohibit specific weak passwords.
- ✓
Configure a custom banned passwords list in Microsoft Entra ID Password Protection.
Why this is correct
Configuring a custom banned passwords list in Microsoft Entra ID Password Protection allows you to define words, patterns, or strings that Entra ID automatically rejects whenever a user creates or resets a password. The service uses fuzzy matching (e.g., normalizing case, substitutions like '0' for 'o') and evaluates both the global Microsoft-list and your custom list, ensuring users cannot choose any password that fails the policy. This directly fulfills the requirement for a cloud-based password restriction.
- ✗
Set a fine-grained password policy in on-premises Active Directory and sync it to Azure AD.
Why it's wrong here
A fine-grained password policy (FGPP) is stored and enforced by on-premises Active Directory for DC-authenticated accounts, yet it cannot be synced to Entra ID as a password policy for cloud-native users or for hybrid users authenticating entirely in the cloud. FGPP settings like complexity and history do not include a custom banned word list, and Entra ID does not read on-prem FGPP attributes during password change events, so this approach fails to meet the stated requirement.
- ✗
Enable MFA registration campaign to force users to register for MFA.
Why it's wrong here
An MFA registration campaign only forces users to configure an additional factor (such as Microsoft Authenticator or a phone number) for sign-in; it does not alter, validate, or constrain the user's password. Even after every user registers for MFA, the original password remains unchanged and can still be weak or match known banned terms, so this does nothing to enforce password strength or block specified passwords.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Password hash synchronization
Password hash synchronization is a Microsoft Azure AD Connect feature that synchronizes a hash of a user's on-premises Active Directory password to Azure AD, enabling cloud-based authentication without additional infrastructure.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.