Entra Password Protection is deployed on all writable domain controllers, which already hold a valid cached policy. During a temporary cloud connectivity outage, a user changes a domain password through a DC. Which behavior should the design expect?

Choose the single best answer.

A.Evaluate only the normal AD complexity policy during the outage and assume the valid cached banned-password policy is necessarily unavailable
B.The DC automatically disables all AD password-policy checks when the cloud is unreachable
C.Every password-change request sends the plaintext password through the proxy for real-time cloud approval
D.The DC can evaluate the password against its cached protection policy in addition to applicable AD password policy

Show the answer and explanation

✓ Correct answer

The DC can evaluate the password against its cached protection policy in addition to applicable AD password policy

The DC agent evaluates the password locally using its valid cached protection policy, alongside normal AD password policy. It does not send plaintext passwords for live approval. Cloud loss does not disable all AD checks or invalidate an already available cached policy.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.