mediumMultiple ChoiceObjective-mapped
220-1202 Practice Question: During a routine security audit, you find that…
During a routine security audit, you find that several workstations have the same local administrator password. The company policy requires unique passwords for each machine. Which tool or method should you use to enforce unique local administrator passwords across the domain?
⚠ Common exam trap
CompTIA often tests the misconception that Group Policy can enforce unique passwords, but candidates must remember that Group Policy applies the same setting to all objects in its scope, making it unsuitable for uniqueness; LAPS is the specific Microsoft solution designed for this exact requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy Microsoft LAPS (Local Administrator Password Solution).
Microsoft LAPS (Local Administrator Password Solution) is the correct tool because it automatically manages local administrator passwords on domain-joined computers, storing them in Active Directory and rotating them to unique values per machine. This directly enforces the policy of unique local admin passwords without manual intervention, using the `AdmPwd` extension and Group Policy to configure password complexity and rotation intervals.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Group Policy to set a standard local admin password.
Why it's wrong here
While Group Policy can enforce password complexity or even set a specific password, applying a standard local admin password across all workstations creates a single point of failure. If this common password is compromised, every machine becomes vulnerable, which is a significant security risk and directly violates the principle of unique, strong credentials for each endpoint.
- ✗
Enable BitLocker on each workstation.
Why it's wrong here
BitLocker is a full disk encryption feature designed to protect data at rest by encrypting the entire volume, making data unreadable without the correct key. While crucial for data security, especially on mobile devices, it operates independently of user account management and password policies. It does not provide any mechanism for generating, rotating, or securing unique local administrator account passwords.
- ✓
Deploy Microsoft LAPS (Local Administrator Password Solution).
Why this is correct
Microsoft LAPS is specifically designed to address the challenge of managing local administrator account passwords across an organization. It automatically generates a unique, complex password for the local administrator account on each domain-joined computer, stores it securely in Active Directory, and can enforce password rotation policies. This solution ensures that each workstation has a distinct local admin password, significantly enhancing security and simplifying management.
- ✗
Disable the local administrator account on all workstations.
Why it's wrong here
Disabling the built-in local administrator account, while seemingly secure, can create significant operational challenges. Certain legacy applications or critical troubleshooting scenarios may rely on this account's presence and specific permissions. Furthermore, the question implies a need to manage these accounts securely with unique passwords, not eliminate them entirely, which would contradict the underlying requirement for local administrative access when needed.
Go deeper
Related to this question
About these practice questions
One of 495 original 220-1202 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.