220-1101 Question 278
Single answerTrusted Platform Module (TPM) security featuresA technician is preparing a company laptop for a sales manager who frequently travels with sensitive customer data. The organization wants to use full-disk encryption so that the drive remains protected if the laptop is lost or stolen, and they want the decryption key to be protected by the system hardware rather than stored only in software. Which component should the technician verify is present and enabled in the system firmware before configuring encryption?
- A
Trusted Platform Module (TPM)
- B
Unified Extensible Firmware Interface (UEFI) Secure Boot
- C
Self-Monitoring, Analysis, and Reporting Technology (SMART)
- D
Virtual Trusted Platform Module (vTPM)
Show answer and explanation
Correct answer: A
Explanation
The best answer is Trusted Platform Module (TPM). In real-world A+ scenarios, TPM is the security feature most directly associated with protecting cryptographic keys for technologies like BitLocker. TPM can securely store keys, support platform integrity checks, and reduce the risk of exposing encryption secrets through standard software storage methods. UEFI Secure Boot is another important security control, but its purpose is to validate the boot chain rather than store disk encryption keys. SMART is related to drive reliability, not security. vTPM is relevant in virtualized systems, not standard physical laptop deployments. This aligns with common vendor and Microsoft guidance for using TPM 2.0 with modern device security and encryption deployments.
- A. Correct.
Correct. A Trusted Platform Module (TPM) is a hardware-based security chip used to securely store cryptographic keys and measurements. On business laptops, TPM is commonly used with full-disk encryption solutions such as BitLocker to help protect the encryption keys from software-based attacks and to support measured boot. A technician would typically confirm that TPM is installed, enabled, and ready in firmware/BIOS settings before deploying hardware-backed drive encryption.
- B. Incorrect.
Incorrect. UEFI Secure Boot helps ensure that only trusted bootloaders and operating system components load during startup, which protects the boot process from certain types of malware. However, Secure Boot does not serve as the dedicated hardware storage location for disk encryption keys. It complements platform security but does not replace TPM for hardware-backed key protection.
- C. Incorrect.
Incorrect. SMART monitors drive health attributes and can provide warning signs of impending storage failure. It is useful for maintenance and troubleshooting, but it has no role in storing encryption keys or providing hardware-backed cryptographic protection for full-disk encryption.
- D. Incorrect.
Incorrect. A virtual TPM (vTPM) is typically associated with virtual machines and virtualized environments, where a software-defined TPM is presented to the guest operating system. In this scenario, the technician is preparing a physical laptop, so the relevant feature is the system's physical TPM chip or firmware TPM supported by the platform, not a vTPM intended for VMs.