SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that users can use the same password on-premises and in the cloud without having to sync password hashes. Additionally, you want to prevent accounts from being locked out after a few bad password attempts in the cloud. Which Microsoft Entra feature should you implement?
⚠ Common exam trap
Test-takers frequently confuse pass-through authentication with password writeback, thinking that pass-through authentication alone prevents cloud lockouts, but it does not—smart lockout is required to decouple cloud lockout from on-premises lockout thresholds.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy password writeback and enable Microsoft Entra smart lockout.
Password writeback enables password changes made in the cloud to be written back to on-premises Active Directory, ensuring the same password is used without syncing password hashes. Microsoft Entra smart lockout prevents accounts from being locked out after a few bad password attempts in the cloud by intelligently recognizing and blocking malicious sign-in attempts while allowing legitimate users to continue, without locking the on-premises account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use password hash synchronization and set up custom lockout policies.
Why it's wrong here
Password Hash Synchronization (PHS) is a one-way synchronization method, sending password hashes from on-premises Active Directory to Microsoft Entra ID. It does not provide the capability for passwords changed or reset in Microsoft Entra ID to be written back to the on-premises directory. Therefore, it fails to address the need for managing on-premises passwords from the cloud. Furthermore, custom on-premises lockout policies would not inherently protect against cloud-based brute-force attacks targeting Microsoft Entra ID directly.
- ✓
Deploy password writeback and enable Microsoft Entra smart lockout.
Why this is correct
Deploying password writeback, a feature of Microsoft Entra Connect, allows users to reset or change their Microsoft Entra ID password and have that new password synchronized back to their on-premises Active Directory account. This ensures password consistency across the hybrid environment and enables cloud-initiated password management for on-premises accounts. Concurrently, enabling Microsoft Entra smart lockout protects user accounts from brute-force attacks by intelligently locking out malicious actors while allowing legitimate users to continue accessing their accounts, specifically preventing lockouts in Microsoft Entra ID.
- ✗
Implement federation with Active Directory Federation Services (AD FS).
Why it's wrong here
While federation with Active Directory Federation Services (AD FS) allows users to authenticate against their on-premises Active Directory for cloud resources, it primarily handles authentication delegation rather than password management synchronization. AD FS does not inherently provide the capability for passwords changed in Microsoft Entra ID to be written back to on-premises AD. Additionally, AD FS does not offer Microsoft Entra smart lockout functionality, as its lockout mechanisms are tied to the on-premises AD and not the cloud identity provider.
- ✗
Implement pass-through authentication and configure on-premises lockout thresholds.
Why it's wrong here
Pass-through Authentication (PTA) directly validates user credentials against on-premises Active Directory when users attempt to sign in to Microsoft Entra ID. While it leverages on-premises lockout policies for cloud sign-ins, PTA itself does not support the password writeback feature, meaning a password change initiated in Microsoft Entra ID cannot be synchronized back to the on-premises directory. Therefore, it fails to address the requirement for managing on-premises passwords from the cloud.
Visual reference
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
Hybrid identity
Hybrid identity is an approach that synchronizes and manages user identities across both on-premises directories and cloud-based services, allowing seamless access to resources in both environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.