220-1102 Question 498
Single answerDevice encryptionA technician is preparing a Windows 11 Pro laptop for a sales executive who frequently travels with confidential customer data. Company policy requires full-disk encryption and the ability to verify recovery information before the user leaves. The laptop has a TPM 2.0 chip and UEFI firmware enabled. Which action should the technician take FIRST to meet the requirement with the least user impact?
- A
Turn on BitLocker for the operating system drive and confirm the recovery key has been backed up to the appropriate location
- B
Enable EFS on the executive's Documents folder and export the user's certificate to removable media
- C
Create a password-protected ZIP archive for all customer files and store the password in the user's email
- D
Convert the system drive to a dynamic disk and configure NTFS permissions for the sales group
Show answer and explanation
Correct answer: A
Explanation
This scenario is testing the ability to choose the correct Windows device-encryption technology for a business laptop. For A+ Core 2, BitLocker is the standard Windows full-disk encryption solution for supported editions such as Pro, Enterprise, and Education. A TPM helps protect the encryption keys and provides a smoother user experience than requiring a startup key or PIN alone. Best practice is to enable BitLocker and verify recovery-key escrow or backup before deployment, such as saving the recovery key to an approved organizational location. EFS is often confused with BitLocker, but EFS protects individual files and folders rather than the entire volume. Microsoft documentation distinguishes BitLocker as device or volume encryption and EFS as file-level encryption, which is why BitLocker is the correct answer here.
- A. Correct.
Correct. BitLocker is Microsoft's full-volume encryption feature and is the appropriate choice for full-disk encryption on Windows 11 Pro. With TPM 2.0 and UEFI already present, BitLocker can be enabled with minimal disruption to the user. Verifying that the recovery key is backed up is a critical deployment step so the device can be recovered if hardware changes or boot validation issues trigger recovery mode.
- B. Incorrect.
Incorrect. EFS encrypts files or folders, not the entire drive. Although EFS can protect specific data, it does not satisfy a requirement for full-disk encryption. Exporting the certificate is good practice for EFS recovery, but it does not address the company policy in this scenario.
- C. Incorrect.
Incorrect. Password-protected ZIP archives are not a full-disk encryption solution and depend on the user to manually store and maintain files inside the archive. Storing the password in the user's email also weakens security and is not an appropriate enterprise control for protecting sensitive data on a traveling executive's laptop.
- D. Incorrect.
Incorrect. Dynamic disks and NTFS permissions manage storage configuration and file access control, but they do not encrypt the device. Someone who steals the laptop could still attempt offline access to data if the drive is not encrypted.