What is the best way to keep employees on a LAN from unauthorized activity or other mischief?

A.
Reduce each user’s permissions to the minimum needed to perform the tasks required by his or her job

B.
Limit the number of logins available to all users to one at a time

C.
Limit the number of files that any one user can have open at any given time

D.
Implement a zero-tolerance policy in regard to employees who load games or other unauthorized software on the company’s computers

Explanation:
Obviously you don’t give the employees free roam of the LAN. Accidents can happen (type a file name or file path wrong) or some employees may become curious. By giving them only the permissions that they need to do their job, can drastically limit where those users can go and cause damage.
Incorrect Answers:
B: The objective in the question is how to prevent an employee from unauthorized activity. Having multiple logons does cause some security concerns, but not that of the user. As long as the permissions are locked up tight, it won’t matter how many logons the user has, if one can’t get unauthorized access, then none should,
C: To limit the number of open files does not prevent this activity, and may prevent the user from actually doing work. Some programs will open multiple files, most programs open more than one file.
1D0-470
D: This is a good step and policy to implement. It still does not prevent unauthorized activity of corporate assets.