220-1102 Question 355
Single answer2.2 Given a scenario, configure and apply basic Microsoft Windows OS security settings.A technician is preparing several Windows 11 laptops for temporary contractors. The contractors need to run a line-of-business application, but the company wants to reduce the risk of malware and unauthorized system changes. The technician must allow the users to perform their jobs while preventing software installations and limiting access to system-wide settings as much as possible. Which action should the technician take FIRST to meet this requirement?
- A
Create standard user accounts for the contractors and keep the local Administrator account restricted to IT staff
- B
Disable User Account Control (UAC) so the application can run without prompts
- C
Add the contractors to the local Administrators group so they can install any missing application components
- D
Turn off Microsoft Defender Antivirus to prevent conflicts with the line-of-business application
Show answer and explanation
Correct answer: A
Explanation
The best first step is to use standard user accounts and reserve administrator privileges for IT personnel. This follows the security principle of least privilege, which is a core Windows security best practice and aligns with CompTIA A+ Core 2 objectives for configuring Microsoft Windows security settings. In Windows, standard accounts are designed for day-to-day work, while administrative accounts are intended only for tasks requiring elevated rights. UAC should remain enabled because it helps control elevation and protect against unauthorized system changes. Microsoft security guidance consistently recommends limiting administrative privileges, using standard accounts for regular users, and keeping built-in protections such as Microsoft Defender Antivirus enabled unless there is a very specific, documented reason not to do so.
- A. Correct.
Correct. Assigning contractors to standard user accounts is a basic Windows security best practice and directly supports least privilege. Standard users can run approved applications but cannot install most software, change system-wide settings, or perform administrative tasks without elevation. Restricting administrative access to IT staff reduces the attack surface and helps prevent unauthorized changes.
- B. Incorrect.
Incorrect. Disabling UAC reduces security by removing an important elevation control and warning mechanism. UAC helps prevent unauthorized administrative changes and is specifically intended to limit the impact of malware or accidental configuration changes. If an application requires elevation to run normally, that should be evaluated and addressed appropriately rather than disabling UAC globally.
- C. Incorrect.
Incorrect. Adding contractors to the local Administrators group gives them broad control over the system, including installing software, changing security settings, and disabling protections. This directly conflicts with the requirement to reduce malware risk and prevent unauthorized system changes. A common misconception is that local admin rights are needed for users to do routine work, but standard accounts are preferred unless a specific business need requires otherwise.
- D. Incorrect.
Incorrect. Turning off Microsoft Defender Antivirus weakens endpoint protection and does not address the requirement to prevent software installation or unauthorized changes. While application compatibility issues can occur, the proper approach is to troubleshoot the application, create exclusions only when justified, or work with the vendor, not disable antivirus protection entirely.