Think of two clocks running in this sentence. One clock is the Principal's action, entering the class, and it is short and finishes quickly. The other clock is the student's action, writing on the board, and it started earlier and was still running when the first clock's action happened.
- Whenever a longer action is interrupted by a shorter one in the past, the longer action takes was/were plus ing.
- The shorter action takes simple past.
- Here entered is simple past and correctly matches the shorter action.
- So the blank, which describes the ongoing longer action, must be was writing.
This pattern is very common in exams: When X happened, Y was doing something. Always check which action is the background action first.