220-1102 Question 247
Single answerAdministrativeA technician is preparing a Windows 11 workstation for a temporary contractor who needs to run a single line-of-business application and access one shared folder. Company policy requires limiting changes to the system, reducing malware risk, and preventing the user from installing software. Which account configuration is the BEST choice for this user?
- A
Create a standard user account for the contractor
- B
Create a local administrator account for the contractor
- C
Have the contractor use the built-in Administrator account
- D
Create a guest account for the contractor
Show answer and explanation
Correct answer: A
Explanation
The best answer is to create a standard user account. In administrative account management, technicians should apply the principle of least privilege: users should receive only the permissions necessary to perform their jobs. For a temporary contractor who needs to run a specific application and access a shared folder, a standard account provides the right balance of usability and security. Administrator-level accounts should be reserved for tasks that require elevated privileges, and the built-in Administrator account should not be used for routine work. Microsoft security guidance and common endpoint management best practices consistently recommend avoiding unnecessary administrative rights to reduce accidental changes, malware impact, and unauthorized software installation.
- A. Correct.
Correct. A standard user account follows the principle of least privilege, which is a core administrative best practice. Standard users can run approved applications and access permitted resources, but they cannot install most software, change system-wide settings, or perform administrative tasks without elevation. This is the most appropriate configuration for a temporary contractor who only needs limited access.
- B. Incorrect.
Incorrect. A local administrator account grants elevated privileges, allowing the contractor to install software, change system settings, and potentially weaken security controls. This conflicts with the stated requirement to limit changes to the system and reduce malware risk. A technician might choose this option for convenience, but it violates least-privilege administration.
- C. Incorrect.
Incorrect. The built-in Administrator account is intended for system administration and recovery tasks, not everyday user activity. Using it for a contractor significantly increases risk because it provides unrestricted access to the local system. It is also a poor security practice because highly privileged shared or routine-use accounts reduce accountability and increase the impact of compromise.
- D. Incorrect.
Incorrect. Modern Windows editions do not use the old Guest account model as an appropriate solution for normal business access. Even where guest-style access is considered, it is too limited and not the recommended way to provide controlled, auditable access to company resources. A standard user account is the proper administrative choice.