SC-900 Describe the capabilities of Microsoft Entra Practice Question
A user is locked out of their account after multiple failed sign-in attempts. You need to reduce false lockouts while maintaining security. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Smart Lockout
Smart lockout learns user behavior and reduces false lockouts. Option A is wrong because requiring MFA does not prevent account lockouts; it adds another authentication factor but does not affect the lockout policy. Option B is wrong because disabling account lockout reduces security. Option D is wrong because increasing the lockout threshold may increase risk by allowing more brute-force attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require MFA for all users
Why it's wrong here
Requiring multi-factor authentication (MFA) for all users enhances overall account security by adding a second verification step. However, MFA is typically prompted *after* a successful primary authentication (e.g., password). Account lockouts occur due to multiple *failed* primary authentication attempts, meaning the MFA challenge is never reached. Consequently, implementing MFA does not directly prevent or mitigate lockouts caused by repeated incorrect password entries.
- ✗
Disable account lockout
Why it's wrong here
Disabling account lockout entirely would remove a critical security control designed to protect user accounts from brute-force and password spray attacks. Without a lockout mechanism, an attacker could make an unlimited number of password guesses against an account without any impediment. This significantly increases the risk of unauthorized access and compromises the integrity of user credentials, making it an unacceptable security posture.
- ✓
Enable Smart Lockout
Why this is correct
Enabling Smart Lockout is the most effective solution because it leverages cloud intelligence and machine learning to differentiate between legitimate users making typos and malicious attackers. Instead of a static threshold, Smart Lockout tracks failed sign-in attempts across various IP addresses and locations. It intelligently locks out suspicious attempts from unfamiliar sources while allowing a legitimate user to continue trying from a known location, significantly reducing false lockouts without compromising security.
- ✗
Increase lockout threshold to 20 attempts
Why it's wrong here
Increasing the account lockout threshold to 20 attempts would indeed reduce the likelihood of legitimate users being locked out due to minor typos. However, this approach significantly broadens the attack surface for malicious actors. A higher threshold grants attackers more opportunities to perform brute-force or password spray attacks before the account is secured, thereby increasing the risk of successful unauthorized access and compromising account security.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.