Your network contains an Active Directory domain.
A user named User1 takes a leave of absence for one year.
You need to restrict access to the User1 user account while User1 is away.
What should you do?

A.
From the Default Domain Policy, modify the account lockout settings.

B.
From the Default Domain Controller Policy, modify the account lockout settings.

C.
From the properties of the user account, modify the Account options.

D.
From the properties of the user account, modify the Session settings.

Explanation:
Account lockout settings deal with logon security, like how many times a wrong password
can be entered before an account gets locked out, or after how many minutes a locked out
user can try again.
To really restrict access to the User1 account it has to be disabled, by modifying the account
options.

http://blogs.technet.com/b/msonline/archive/2009/08/17/disabling-and-deleting-useraccounts.aspx
Disabling a user account prevents user access to e-mail and Microsoft SharePoint Online
data, but retains the user’s data. Disabling a user account also keeps the user license
associated with that account. This is the best option to utilize when a person leaves an
organization temporarily.