SC-900 Describe the capabilities of Microsoft Entra Practice Question
A user is locked out of their account after multiple failed sign-in attempts. You need to reduce false lockouts while maintaining security. What should you do?
⚠ Common exam trap
SC-900 often tests the misconception that increasing the lockout threshold or disabling lockout is a good way to reduce false lockouts, when the correct answer is to use Smart Lockout, which intelligently differentiates based on location.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Smart Lockout
Microsoft Entra Smart Lockout is designed to protect against brute-force attacks while reducing false lockouts for legitimate users. It uses a combination of familiar location and unfamiliar location thresholds to differentiate between malicious attempts and valid users who may have mistyped their password. Enabling Smart Lockout allows you to set a higher threshold for familiar locations and a lower threshold for unfamiliar locations, thus maintaining security without locking out legitimate users. The other options either do not address false lockouts (MFA) or weaken security (disabling lockout, increasing threshold globally).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require MFA for all users
Why it's wrong here
Requiring multi-factor authentication (MFA) for all users enhances overall account security by adding a second verification step. However, MFA is typically prompted *after* a successful primary authentication (e.g., password). Account lockouts occur due to multiple *failed* primary authentication attempts, meaning the MFA challenge is never reached. Consequently, implementing MFA does not directly prevent or mitigate lockouts caused by repeated incorrect password entries.
- ✗
Disable account lockout
Why it's wrong here
Disabling account lockout entirely would remove a critical security control designed to protect user accounts from brute-force and password spray attacks. Without a lockout mechanism, an attacker could make an unlimited number of password guesses against an account without any impediment. This significantly increases the risk of unauthorized access and compromises the integrity of user credentials, making it an unacceptable security posture.
- ✓
Enable Smart Lockout
Why this is correct
Enabling Smart Lockout is the most effective solution because it leverages cloud intelligence and machine learning to differentiate between legitimate users making typos and malicious attackers. Instead of a static threshold, Smart Lockout tracks failed sign-in attempts across various IP addresses and locations. It intelligently locks out suspicious attempts from unfamiliar sources while allowing a legitimate user to continue trying from a known location, significantly reducing false lockouts without compromising security.
- ✗
Increase lockout threshold to 20 attempts
Why it's wrong here
Increasing the account lockout threshold to 20 attempts would indeed reduce the likelihood of legitimate users being locked out due to minor typos. However, this approach significantly broadens the attack surface for malicious actors. A higher threshold grants attackers more opportunities to perform brute-force or password spray attacks before the account is secured, thereby increasing the risk of successful unauthorized access and compromising account security.
Go deeper
Related to this question
Learn chapter
Azure Network Security Groups and Firewalls
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.