220-1102 Question 363
Single answerUser and groupsA technician is preparing a Windows 11 laptop for a temporary employee in the accounting department. The employee needs to run the company's accounting application, save files to their own profile, and print to network printers, but must not be able to install software or change system-wide settings. The laptop is not joined to a domain. Which account configuration should the technician use?
- A
Create a local standard user account for the employee
- B
Create a local administrator account for the employee
- C
Add the employee's account to the Power Users group
- D
Use the built-in Guest account for the employee
Show answer and explanation
Correct answer: A
Explanation
The best answer is to create a local standard user account. In Windows, standard users can run installed applications, work with their own files and settings, and use permitted peripherals such as printers, while being prevented from performing administrative actions that affect the whole system. This is the recommended approach for users who do not need elevated rights. A+ Core 2 objectives emphasize proper user account management and applying least privilege. Microsoft guidance for Windows account types and security best practices supports using standard accounts for daily work and reserving administrator privileges only for administrative tasks.
- A. Correct.
Correct. A local standard user account is the appropriate choice for a user who needs to run installed applications, save files within their own profile, and use printers, but should not be able to install software for all users or modify system-wide settings. This follows the principle of least privilege, which is a core best practice for endpoint security and user administration.
- B. Incorrect.
Incorrect. A local administrator account gives the user elevated privileges, including the ability to install software, change security settings, create and manage other accounts, and make system-wide changes. That exceeds the access required in this scenario and creates unnecessary risk.
- C. Incorrect.
Incorrect. Power Users is a legacy group from older versions of Windows and is not intended as a normal method for delegating limited administrative rights on modern Windows systems. On current Windows versions, it does not provide a supported, practical solution for this requirement and should not be used instead of a standard user account.
- D. Incorrect.
Incorrect. The built-in Guest account is typically disabled by default and is designed for very limited, temporary access. It is not appropriate for a named employee who needs a persistent profile and access to installed business applications. Using Guest would also reduce accountability because it is not a unique user identity.