220-1102 Question 82
Single answerUsersA small company uses Windows 10 Pro laptops joined to a workgroup. A user in Accounting needs to install a line-of-business printer utility that requires administrative rights, but company policy says users must not have local administrator access for daily work. The user also needs to continue using standard user permissions for email and web browsing after the installation is complete. Which action should the technician take FIRST to meet the requirement securely?
- A
Temporarily add the user's account to the local Administrators group, have the user install the software, and remove the account afterward
- B
Log in with a local administrator account or use administrator credentials when prompted by UAC to install the utility, while leaving the user's account as a standard user
- C
Disable User Account Control, install the utility from the user's account, and re-enable UAC after the installation
- D
Change the user account type permanently to Administrator so the printer utility can update itself in the future
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use administrator credentials only for the installation task while keeping the employee's regular account as a standard user. This aligns with the principle of least privilege, a core security best practice emphasized in Microsoft guidance for Windows account types and User Account Control. Standard users should not be granted unnecessary persistent administrative rights just to install software. UAC exists specifically to support this model by allowing elevation when required. In real-world support environments, the technician would typically verify the software is approved, then install it using a local administrator account or by entering admin credentials at the UAC prompt, without changing the user's normal role.
- A. Incorrect.
This is not the best first action. Although temporarily adding the user to the local Administrators group could work, it grants elevated rights to the user's account and increases risk if the user opens other applications, websites, or email during that period. Best practice is to use administrative credentials only for the specific task that requires elevation, not to broaden the user's account permissions.
- B. Correct.
This is correct. In Windows, a standard user can run an installer that requires elevation by providing administrator credentials at the UAC prompt, or a technician can sign in with a local administrator account to perform the installation. This follows least privilege by keeping the user's day-to-day account as a standard user while allowing the required administrative task to be completed securely.
- C. Incorrect.
This is incorrect. Disabling UAC reduces an important security control and is not necessary to install approved software. UAC is designed to allow elevation for administrative tasks without removing protections for the rest of the session. Turning it off is a common but poor shortcut.
- D. Incorrect.
This is incorrect. Permanently making the user an Administrator violates the stated company policy and weakens endpoint security. Standard users should remain standard users unless there is a documented business need and approval to change their role. Future updates should be handled through approved administrative processes, not by granting ongoing elevated rights.