Microsoft Entra Password Protection helps prevent users from choosing weak or commonly used passwords by checking password changes against Microsoft ' s global banned-password list and an administrator-defined custom list.
Option A is correct because the Microsoft Entra Password Protection domain controller (DC) agent extends password validation to on-premises Active Directory Domain Services.
By default, configuring a custom banned-password list in Microsoft Entra ID protects cloud-based password changes but does not automatically extend the enforcement mechanism to domain controllers.
To implement on-premises protection, administrators must deploy the Password Protection DC agent to domain controllers and configure the supporting Microsoft Entra Password Protection proxy service. The proxy retrieves password protection policies from Microsoft Entra ID and makes them available to the DC agents.
Administrators must also enable password protection for Windows Server Active Directory and configure Enforced mode rather than Audit mode.
Option B is incorrect because the Microsoft Entra provisioning agent supports identity provisioning and synchronization scenarios.
Option C is incorrect because password writeback supports writing cloud-initiated password changes to on-premises Active Directory.
Option D is incorrect because password hash synchronization enables cloud authentication using synchronized password hashes; it does not enforce custom banned passwords during on-premises password changes.
Therefore, deploying the DC agent is the correct choice, with the additional deployment components and enforcement configuration required for operation.
Microsoft References:
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-operations
