SC-100 Certification Practice Question #83

Question

You have a hybrid Azure AD tenant that has pass-through authentication enabled.

You are designing an identity security strategy.

You need to minimize the impact of brute force password attacks and leaked credentials of hybrid identities.

What should you include in the design? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Accepted Answer

Two requirements, three tiles. The scenario is a hybrid tenant with pass-through authentication and explicitly no AD FS, which eliminates Extranet Smart Lockout (ESL) — MS Learn and multiple comments confirm ESL is exclusively an AD FS 2016/2019 feature. That leaves Azure AD Password Protection for brute-force attacks (it provides custom smart-lockout and bans common/weak passwords that brute-force and password-spray attacks rely on) and Password hash synchronization for leaked credentials, because MS Learn states leaked-credential detection in Microsoft Entra ID Protection "requires password hash synchronization to be enabled for hybrid users." The highest-voted answer (17 👍) and several corroborating comments adopt this exact pairing. Confidence is held at 84 rather than higher because a vocal minority pushed ESL despite it being inapplicable here, and PHS's leaked-credential check is sometimes debated under PTA — but MS Learn resolves both in favor of this mapping.

More SC-100 practice questions