220-1101 Question 319
Single answerPublic/shared devicesA library has several Windows PCs in a public browsing area. Patrons use them throughout the day to access websites, print documents, and check email. The library director reports that users are leaving personal files on the desktops, changing application settings, and occasionally signing in to online services without logging out. The director wants a solution that reduces the amount of user data retained between sessions and helps return each PC to a known-good state for the next patron. Which action should the technician recommend?
- A
Configure each PC to use a local administrator account so staff can quickly reset user settings after each patron
- B
Implement a guest/public-use profile with restricted permissions and use a restore-at-reboot or mandatory profile solution to discard session changes
- C
Enable file and printer sharing on each PC so patrons can save documents to a central shared folder instead of the local desktop
- D
Join the PCs to the domain and allow patrons to sign in with a shared staff account to simplify access control
Show answer and explanation
Correct answer: B
Explanation
For public/shared devices, best practice is to minimize stored user data, restrict permissions, and return the system to a baseline state between users. In real environments such as libraries, schools, hotel business centers, and kiosks, technicians commonly use non-privileged guest accounts, mandatory or temporary user profiles, and reboot-to-restore solutions to remove unwanted changes and protect privacy. These controls align with general Microsoft and enterprise endpoint management guidance: users on shared systems should not have administrative rights, session data should be cleared or made nonpersistent, and devices should be locked down to only the functions required for their intended use. The recommended approach most directly addresses all parts of the scenario: leftover files, altered settings, and preparing the PC for the next patron.
- A. Incorrect.
This is incorrect. A local administrator account gives far more privilege than is appropriate on a public/shared device. It increases the risk of malware installation, unauthorized configuration changes, and access to system settings. Although staff may need administrative credentials for maintenance, patrons should not use an admin account. The misconception is that easier troubleshooting justifies elevated permissions for routine use.
- B. Correct.
This is correct. Public/shared devices should use restricted accounts and a configuration that minimizes persistent user data. A guest/public-use account limits what patrons can change, while technologies such as mandatory profiles, kiosk-style controls, or restore-at-reboot products help reset the system to a clean state after logout or restart. This directly addresses leftover files, changed settings, and the need to present a known-good environment to the next user.
- C. Incorrect.
This is incorrect. Centralized storage may reduce desktop clutter, but enabling file and printer sharing does not solve the core issue of public-system persistence or configuration tampering. It can also introduce additional security and privacy concerns if permissions are not tightly controlled. The problem is not just where files are stored; it is that the public PCs retain user data and settings between sessions.
- D. Incorrect.
This is incorrect. Allowing patrons to use a shared staff account is poor security practice and breaks accountability. Shared privileged or semi-privileged credentials make it difficult to audit activity and increase the chance of unauthorized access to internal resources. Domain membership may be appropriate in some organizations for management, but using a shared staff sign-in for patrons is not an acceptable control for public/shared devices.