220-1102 Question 3
Single answerWindowsA technician is preparing a Windows 11 laptop for a remote employee who frequently travels and uses public Wi-Fi. The user must be able to sign in to the laptop if internet access is unavailable, but the company also wants to reduce the risk of password compromise and avoid managing separate local passwords. Which sign-in configuration should the technician recommend?
- A
Create a local account with no password so the user can always sign in offline
- B
Join the PC to a workgroup and require a BIOS password for authentication
- C
Sign in with a Microsoft account and configure Windows Hello PIN
- D
Enable Guest access and require the user to switch accounts after connecting to Wi-Fi
Show answer and explanation
Correct answer: C
Explanation
The best answer is to sign in with a Microsoft account and configure Windows Hello PIN. In Windows 10 and Windows 11, users can sign in with a Microsoft account and continue to log in even when offline because Windows caches the necessary credentials locally. Windows Hello PIN is a preferred option because it is device-specific, unlike a traditional password that can be reused across services if compromised. This makes it especially suitable for mobile users who may work without reliable internet access and who face increased risk on public networks. Microsoft documentation and security guidance consistently recommend Windows Hello as a more secure sign-in method than passwords for supported Windows systems.
- A. Incorrect.
This is incorrect because removing the password from a local account significantly weakens security, especially for a traveling user. While a local account can support offline sign-in, the scenario specifically states the company wants to avoid managing separate local passwords and reduce password-compromise risk.
- B. Incorrect.
This is incorrect because a workgroup does not provide user authentication benefits for this scenario, and a BIOS/UEFI password is not a replacement for Windows account sign-in. BIOS passwords help restrict device startup or firmware access, but they do not provide the Windows identity and account protections requested.
- C. Correct.
This is correct because a Microsoft account supports Windows sign-in and can still authenticate locally when the device is offline using cached credentials. Configuring a Windows Hello PIN improves security and convenience because the PIN is tied to that specific device rather than being the user's reusable account password. This aligns with Microsoft best practices for stronger, device-bound sign-in methods on Windows 10/11.
- D. Incorrect.
This is incorrect because the Guest account is not an appropriate secure sign-in solution for a business user. It does not meet the requirement for a personalized, secure account and would create major security and auditing concerns. It also does not address the need to reduce password-compromise risk.