220-1102 Question 326
Single answerKeysA technician is deploying several Windows 11 laptops that use BitLocker drive encryption. One user forgets the PIN used at startup and cannot unlock the encrypted drive after a motherboard firmware change triggers BitLocker recovery mode. The company needs the fastest supported way to regain access to the data without reinstalling Windows or erasing the drive. Which action should the technician take?
- A
Use the BitLocker recovery key that was backed up for the device and enter it at the recovery prompt
- B
Boot into Safe Mode and disable BitLocker from the advanced startup menu
- C
Use Device Manager from Windows Recovery Environment to roll back the TPM driver
- D
Run Startup Repair so Windows can regenerate a new BitLocker key automatically
Show answer and explanation
Correct answer: A
Explanation
This question tests applied knowledge of security keys in a real A+ Core 2 support scenario. BitLocker uses encryption keys protected by mechanisms such as TPM and optional user authentication like a PIN. When a hardware or firmware change occurs, BitLocker may enter recovery mode because the trusted boot measurements no longer match expected values. In that case, the technician should use the recovery key that was previously saved to a Microsoft account, Active Directory, Azure AD/Entra ID, or another approved escrow location. This aligns with Microsoft's BitLocker recovery guidance and standard best practice: back up recovery keys before deployment and use them to restore access when normal protectors fail. The key point is that encryption cannot be bypassed through Safe Mode, Startup Repair, or generic boot troubleshooting tools.
- A. Correct.
Correct. BitLocker recovery is specifically designed for situations where normal unlock methods fail, such as forgotten PINs or hardware/firmware changes that alter measured boot conditions. Entering the 48-digit BitLocker recovery key is the supported method to unlock the drive and regain access to the system without data loss.
- B. Incorrect.
Incorrect. Safe Mode does not bypass BitLocker encryption. If the drive is locked, Windows must be unlocked before the operating system, including Safe Mode, can load. A common misconception is that Safe Mode can bypass security controls, but it cannot decrypt a BitLocker-protected volume without valid unlock credentials or the recovery key.
- C. Incorrect.
Incorrect. While TPM issues can contribute to recovery prompts, rolling back a TPM driver from the recovery environment is not the standard or fastest method to regain access to encrypted data. The immediate supported recovery action is to use the BitLocker recovery key. Troubleshooting TPM or firmware issues can happen after access has been restored.
- D. Incorrect.
Incorrect. Startup Repair addresses certain boot configuration and system file problems, but it does not generate a replacement BitLocker recovery key to unlock an encrypted drive. BitLocker keys are established as part of encryption setup and recovery key management, not recreated by Startup Repair.