220-1102 Question 320
Single answerSecurity guardsA company has placed a public kiosk in its lobby for visitors to check in. The kiosk runs Windows and is managed by the IT department. Recently, a security guard reported that a visitor plugged a USB flash drive into the kiosk and attempted to open system tools from the desktop. Management wants the kiosk locked down so visitors can use only the check-in application and cannot easily access the operating system or attach unauthorized devices. Which security measure would BEST address this requirement?
- A
Configure the kiosk to use assigned access and physically block or disable unused USB ports
- B
Enable Remote Desktop so security guards can monitor the kiosk more easily
- C
Add the visitor accounts to the local Administrators group so the application will not be restricted
- D
Turn off the Windows firewall so the check-in application has full network connectivity
Show answer and explanation
Correct answer: A
Explanation
The best answer is to place the system into a restricted kiosk configuration and prevent use of unnecessary ports. In A+ Core 2 objectives, security best practices include least privilege, physical security controls, and host hardening. A security guard is a useful deterrent and monitoring presence, but guards should be combined with technical controls because they cannot reliably stop every misuse attempt. Microsoft documents Assigned Access/Kiosk mode as a way to limit a Windows device to a specific app experience, and standard endpoint security practice supports disabling or physically blocking unused ports to reduce removable-media risk. Together, these controls provide layered security that is appropriate for a publicly accessible workstation.
- A. Correct.
Correct. Assigned access (kiosk mode) in Windows is designed to restrict a device to a single application or limited set of functions, which is appropriate for a public lobby kiosk. In addition, physically blocking or disabling unused USB ports helps prevent the use of unauthorized removable media and other peripherals. This combination directly addresses both parts of the scenario: limiting OS access and reducing the risk of device-based attacks.
- B. Incorrect.
Incorrect. Remote Desktop may help administrators or staff access the system remotely, but it does not prevent visitors from interacting with the local operating system or plugging in USB devices. A security guard monitoring the kiosk is useful as a physical security control, but enabling RDP is not the best technical control for locking down a public kiosk.
- C. Incorrect.
Incorrect. Granting administrative privileges to visitor accounts would significantly weaken security. It would make it easier, not harder, for users to bypass restrictions, install software, change settings, or access sensitive system tools. This is the opposite of the principle of least privilege, which is a core security best practice.
- D. Incorrect.
Incorrect. Disabling the Windows firewall reduces the host's security posture and does not solve the problem of users accessing system tools or connecting unauthorized USB devices. If the application needs network access, firewall rules should be configured properly rather than disabling the firewall entirely.