Data Loader is a client application that uses the Salesforce API to access data. When a user attempts to log in to Salesforce via the API from an IP address that is not on the organization's list of trusted IP ranges, they must provide a security token in addition to their password. The standard procedure is to append the security token directly to the end of the password in the password field for authentication.

A. An administrator profile already includes the "API Enabled" system permission by default, which is required to use Data Loader. A separate permission set is typically not needed for this purpose.

C. The Data Import Tool (Data Import Wizard) is a separate, web-based tool with different capabilities and limitations. The question specifically asks about using the Data Loader application.

D. Resetting the password or security token is only necessary if the administrator has forgotten them or if security has been compromised. It is not a standard step for using Data Loader.

1. Salesforce Help, "Reset Your Security Token": "When you access Salesforce from an IP address that’s outside your company’s trusted IP range using a desktop client or the API, you need a security token to log in. A security token is a case-sensitive alphanumeric code that you append to your password."

2. Salesforce Help, "Log In with Data Loader": "Enter your Salesforce password. Note: If your organization restricts IP addresses... you add [the security token] to the end of your password when logging in." This confirms the concatenation of the password and security token for login.

3. Salesforce Developer Documentation, SOAP API Developer Guide, "Security and the API" section: This guide explains the security model for API access, stating, "API access from an unknown IP address requires a security token... The client application must pass the security token in the password field of the login() call. The security token must be concatenated to the user's password."