220-1102 Question 476
Single answerUniquenessA technician is creating local user accounts on several Windows 11 PCs in a small accounting office. Company policy requires each employee to have an individual account so file access, audit logs, and password changes can be tied to a specific person. One employee asks to share the existing "FrontDesk" account with a coworker because they work the same shift and use the same applications. Which action best meets the company requirement while maintaining proper account management practices?
- A
Keep the shared FrontDesk account, but require both employees to use a complex password known only to them
- B
Create a separate user account for the coworker and assign the same permissions as the existing FrontDesk account
- C
Rename the FrontDesk account to include both employees' names so activity can be associated with either user
- D
Configure both employees to use the local Administrator account only during their shifts
Show answer and explanation
Correct answer: B
Explanation
The key concept is uniqueness: each user should be identified by a unique account so activity can be traced to an individual. In CompTIA A+ Core 2 security objectives, this aligns with proper access control, account management, and accountability practices. The best solution is to create separate accounts and then apply the necessary permissions through local groups, NTFS permissions, or application configuration. This preserves auditing, supports password management per user, and follows the principle of least privilege. Microsoft security guidance and general identity-management best practices both emphasize avoiding shared accounts except in rare, tightly controlled service-account scenarios, which do not apply to normal end-user logons.
- A. Incorrect.
This is incorrect because a shared account does not provide uniqueness. Even with a strong password, actions in logs and access records cannot be reliably tied to one person. Shared credentials also weaken accountability and violate common security best practices.
- B. Correct.
This is correct because uniqueness requires each user to have an individual account. Creating a separate account for the coworker preserves accountability while still allowing the technician to assign identical permissions, group memberships, or application access as needed.
- C. Incorrect.
This is incorrect because renaming a shared account does not make it unique. Two people would still be using the same credentials, so audit trails, password ownership, and responsibility for actions would remain unclear.
- D. Incorrect.
This is incorrect because users should not routinely use the local Administrator account for normal work. In addition to violating least privilege, sharing an administrator-level account removes user uniqueness and increases security risk.