220-1102 Question 349
Single answerJust-in-time accessA technician needs local administrator rights on a user's Windows laptop to install a line-of-business application. The company wants to reduce standing privileged accounts and ensure elevated rights are available only for the minimum time needed. Which solution best meets this requirement?
- A
Assign the technician to the local Administrators group permanently so future installs are easier
- B
Use just-in-time access so the technician receives temporary administrator privileges only during the approved maintenance window
- C
Share the built-in Administrator account password with the technician and change it after the install is finished
- D
Disable User Account Control (UAC) so the installation can run without prompting for elevated permissions
Show answer and explanation
Correct answer: B
Explanation
Just-in-time (JIT) access is designed to reduce standing privileges by granting elevated permissions only when required and only for a limited duration. In this scenario, the organization wants the technician to have administrator rights long enough to install the application and no longer. That makes temporary, approved elevation through JIT the best solution. This approach supports the principle of least privilege and improves accountability compared with shared administrator passwords or permanent admin group membership. Security best practices from major vendors and frameworks consistently recommend minimizing persistent privileged access, using time-bound elevation, and maintaining auditable user-specific privileged actions.
- A. Incorrect.
This is incorrect because permanent membership in the local Administrators group creates standing privilege. That increases the attack surface and violates the goal of granting elevated access only when needed. A core principle of just-in-time access is minimizing how long privileged rights exist.
- B. Correct.
This is correct because just-in-time access provides elevated privileges only for a limited, approved period and then removes them automatically or through policy. This aligns with least privilege and is the best fit when a technician needs admin rights briefly to complete a task such as software installation.
- C. Incorrect.
This is incorrect because sharing a common privileged account undermines accountability and auditing. It also creates security risk because multiple people could know the same high-privilege credential. Best practice is to avoid shared admin credentials and instead grant time-limited, identity-based access.
- D. Incorrect.
This is incorrect because UAC is a security feature that helps control elevation. Disabling it does not implement just-in-time access and weakens system security. The issue is not the existence of prompts, but how privileged rights are assigned and controlled.