Hotspot Question A user named User1 attempts to sign in to the tenant by entering the following incorrect passwords: Pa55w0rd12 Pa55w0rd12 Pa55w0rd12 Pa55w.rd12 Pa55w.rd123 Pa55w.rd123 Pa55w.rd123…

The correct answer is Tracked sign-in attempts:: 11; Unlock by:: Performing a self-service password reset (SSPR). This question tests knowledge of Azure AD Smart Lockout, which tracks failed sign-in attempts and locks accounts after a threshold is reached, while also understanding how users can self-unlock via Self-Service Password Reset (SSPR).

Submitted by miguelv· Mar 6, 2026Implement authentication and access management

Question

Hotspot Question A user named User1 attempts to sign in to the tenant by entering the following incorrect passwords: Pa55w0rd12 Pa55w0rd12 Pa55w0rd12 Pa55w.rd12 Pa55w.rd123 Pa55w.rd123 Pa55w.rd123 Pa55word12 Pa55word12 Pa55word12 Pa55w.rd12 You need to identify how many sign-in attempts were tracked for User1, and how User1 can unlock her account before the 300-second lockout duration expires. What should identify? To answer, select the appropriate NOTE: Each correct selection is worth one point. Answer:

Answer Area

Tracked sign-in attempts:11
451011
Unlock by:Performing a self-service password reset (SSPR)
Clearing the browser cacheSigning in by using inPrivate browsing modePerforming a self-service password reset (SSPR)

How the community answered

(1 responses)

11|Performing a self-service password reset (SSPR)
100% (1)

Explanation

This question tests knowledge of Azure AD Smart Lockout, which tracks failed sign-in attempts and locks accounts after a threshold is reached, while also understanding how users can self-unlock via Self-Service Password Reset (SSPR).

Approach. Azure AD Smart Lockout counts 'familiar' vs 'unfamiliar' location attempts separately. The default lockout threshold is 10 failed attempts. Analyzing the password list: Pa55w0rd12 (3 attempts), Pa55w.rd12 (1 attempt), Pa55w.rd123 (3 attempts), Pa55word12 (3 attempts), Pa55w.rd12 (1 attempt) = 11 total attempts listed. However, Smart Lockout uses a concept where the same incorrect password repeated is counted only once (to prevent lockout from a cached bad password scenario) - so repeated identical passwords in succession may only count once per unique bad password group. The tracked sign-in attempts recorded are 10 (the lockout threshold), meaning the account locks after 10 failed attempts. To unlock the account before the 300-second duration expires, User1 can use Self-Service Password Reset (SSPR) to reset her password, which clears the lockout counter and restores access immediately without waiting for the timer.

Concept tested. Azure AD Smart Lockout behavior - specifically how failed sign-in attempts are counted (including the duplicate password protection feature), the default lockout threshold of 10 attempts, the 300-second (60-second default, but configurable) lockout duration, and the ability for users to bypass lockout early by performing a Self-Service Password Reset (SSPR).

Reference. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-smart-lockout

Topics

#smart lockout#SSPR#lockout duration#password protection

Community Discussion

No community discussion yet for this question.

Full SC-300 Practice