220-1102 Question 57
Single answerEnterpriseA company is opening a temporary project office for 18 contractors who need access to email, internal web applications, and shared documents for the next six months. The IT department wants the users to sign in with the same credentials they use at headquarters and wants to apply the same password and account lockout policies. The office does not need its own local servers, and minimizing administrative overhead is a priority. Which of the following is the BEST solution?
- A
Create local user accounts on each workstation in the temporary office
- B
Deploy a workgroup and configure identical usernames and passwords on all PCs
- C
Join the workstations to the existing Active Directory domain over the corporate network/VPN
- D
Install a standalone file server at the temporary office and manage accounts separately
Show answer and explanation
Correct answer: C
Explanation
The best answer is to join the temporary office workstations to the organization's existing Active Directory domain. In an enterprise environment, a domain provides centralized authentication and authorization, allowing users to sign in with one set of credentials across organizational resources. It also enables enforcement of password policies, account lockout policies, and other security settings through Group Policy, which is a core enterprise management practice. By contrast, local accounts and workgroups are decentralized and create significant administrative overhead. Microsoft enterprise best practices for Windows environments emphasize domain-based management for centralized identity, policy enforcement, and scalable administration. For an A+ Core 2 candidate, this scenario tests understanding of the difference between workgroups and domains and the practical benefit of centralized management in enterprise deployments.
- A. Incorrect.
This is incorrect because local user accounts are managed individually on each workstation. That approach does not provide centralized authentication, consistent enforcement of enterprise password policies, or efficient administration for multiple users. A technician might choose this if they are thinking only about quick setup, but it does not meet the requirement for using the same credentials and policies as headquarters.
- B. Incorrect.
This is incorrect because a workgroup is a peer-to-peer model and does not provide centralized identity management, domain-based authentication, or Group Policy enforcement. Even if identical usernames and passwords were manually created, they would still be separate local accounts on each machine. This is a common misconception when someone confuses matching credentials with true centralized authentication.
- C. Correct.
This is correct because joining the workstations to the existing Active Directory domain allows the contractors to authenticate with the same enterprise credentials used at headquarters. It also enables centralized management of password policies, account lockout policies, and other settings through domain services and Group Policy. Using the corporate network or a site-to-site/client VPN supports access to domain resources without requiring separate local servers in the temporary office, which aligns with the goal of minimizing administrative overhead.
- D. Incorrect.
This is incorrect because a standalone server with separately managed accounts creates another administrative silo. Users would not automatically use the same credentials and policies from headquarters unless integrated with the existing domain, and the scenario explicitly states that the office does not need its own local servers. Someone might choose this option thinking a local server improves performance, but it does not best satisfy the identity and management requirements.