Help desk staff must restart one Windows service and read its event logs on 150 servers, but they should not have local administrator rights or interactive logon to the systems. Which approach best supports this requirement?

Create one shared local administrator account for the entire help desk team.

This grants far more privilege than needed and makes accountability and auditing difficult.

Add the staff to the local Administrators group on every server.

Local administrator access is excessive for a single service task and violates least privilege.

Run the maintenance job under each technician's personal account on a schedule.

Personal accounts complicate auditing and may fail if a user leaves, changes roles, or lacks consistent permissions.

What does this SY0-701 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Use a Just Enough Administration constrained endpoint for the allowed tasks. — Just Enough Administration is the best fit because it allows a constrained administrative endpoint that only exposes approved commands, such as restarting a specific service or reading certain logs. This supports least privilege, stronger auditing, and repeatable administration without granting full interactive admin rights. It is especially useful when many systems need the same limited task performed consistently and securely. Why others are wrong: A shared administrator account is hard to audit and far too powerful. Adding staff to local Administrators violates least privilege and increases risk on every server. Using personal accounts for scheduled tasks creates brittle administration and complicates accountability when personnel change or access needs shift.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.