220-1102 Question 383
Single answerEncrypting File System (EFS)A sales manager uses a Windows 10 Pro laptop and stores sensitive customer proposals in an NTFS folder encrypted with Encrypting File System (EFS). The laptop's motherboard fails, and IT moves the SSD to another Windows 10 Pro computer. The manager can sign in with the same domain account, but opening the encrypted files returns an "Access is denied" message. No recent file copies exist. Which action is the BEST way to restore access to the encrypted files?
- A
Import the user's previously exported EFS certificate and private key, or recover the files using the designated Data Recovery Agent certificate
- B
Take ownership of the files and grant the user Full Control NTFS permissions
- C
Disable BitLocker on the replacement computer so Windows can read the encrypted folder normally
- D
Copy the files to a FAT32-formatted USB drive to remove the encryption attribute
Show answer and explanation
Correct answer: A
Explanation
The key troubleshooting point is that EFS relies on certificates and private keys, not just user names, passwords, or NTFS permissions. Even if the user logs on with the same domain account after the drive is moved, access to EFS-encrypted files requires the original EFS private key or recovery through a configured Data Recovery Agent. This is why best practice is to back up the user's EFS certificate and private key before a failure occurs. Microsoft documentation and Windows administration guidance consistently distinguish EFS from BitLocker: EFS is file-level encryption on NTFS volumes, while BitLocker protects entire volumes. In a real support scenario, technicians should verify whether the user exported the EFS certificate, whether certificates were archived via domain policy, and whether a DRA exists in the environment.
- A. Correct.
Correct. EFS encrypts files using a file encryption key protected by the user's EFS certificate and private key. Moving the drive to another system does not remove that requirement. To decrypt or open the files, the user must have access to the original EFS private key, typically restored by importing a backed-up certificate (.pfx), or an authorized Data Recovery Agent (DRA) can recover the files if one was configured. This is the proper recovery method for EFS-protected data.
- B. Incorrect.
Incorrect. NTFS ownership and permissions control authorization to the file system object, but they do not replace the cryptographic requirement of EFS. A user can own the file and still be unable to open it without the correct EFS private key. This distractor reflects the common misconception that file permissions and encryption are the same issue.
- C. Incorrect.
Incorrect. BitLocker and EFS are different technologies. BitLocker encrypts an entire volume, while EFS encrypts individual files and folders on NTFS. Disabling BitLocker, even if it were enabled, would not provide the EFS private key needed to open the files. This option tests confusion between full-disk encryption and file-level encryption.
- D. Incorrect.
Incorrect. Copying encrypted EFS files does not reliably strip encryption in a way that restores access when the user lacks the private key. In practice, the files must first be decrypted by an authorized user or recovery agent. Also, FAT32 does not support EFS, but that does not bypass the requirement for decryption during access. Someone might choose this because they know EFS depends on NTFS, but the key problem is missing cryptographic credentials, not the destination file system.