220-1102 Question 492
Single answerApply account expiration datesA company hires a tax consultant who needs access to a Windows 11 workstation and shared company resources only through April 30. The consultant should be able to sign in normally until then, but the account must automatically stop working after that date without requiring manual intervention from the help desk. Which action should a technician take?
- A
Set an account expiration date of April 30 on the consultant's user account
- B
Require the consultant to change the password on April 30
- C
Add the consultant to a limited local group instead of Users
- D
Disable the account after business hours on April 30 using Local Security Policy
Show answer and explanation
Correct answer: A
Explanation
The best solution is to apply an account expiration date to the temporary user account. This is a standard best practice for managing temporary access because it enforces the principle of least privilege over time and reduces the risk of forgotten active accounts after a contractor or temporary employee leaves. In Windows, account expiration can be configured through user account management tools such as Local Users and Groups for local accounts or Active Directory Users and Computers for domain accounts. Microsoft documentation and standard administrative practice distinguish account expiration from related controls such as password expiration, password change requirements, group membership, and manual account disabling. Those settings may be useful for other purposes, but they do not automatically terminate account access on a specific end date the way account expiration does.
- A. Correct.
Correct. Setting an account expiration date is the proper way to allow temporary access that automatically ends on a specific date. In Windows account management, this is designed for contractors, seasonal workers, and temporary staff who should lose access after a known end date without needing someone to remember to disable the account manually.
- B. Incorrect.
Incorrect. Forcing a password change affects credential freshness, not whether the account remains valid. The consultant could simply set a new password and continue signing in, so this does not meet the requirement to automatically prevent access after April 30.
- C. Incorrect.
Incorrect. Group membership controls permissions and access scope, not account lifetime. Placing the user in a more limited group may reduce privileges, but it does not cause the account to expire on a certain date.
- D. Incorrect.
Incorrect. Disabling the account would stop access, but this option depends on manual action by an administrator and does not satisfy the requirement for automatic expiration. Local Security Policy also does not exist for the purpose of scheduling a specific user account to disable itself on a date.