SY0-701 Question 100
Single answerCryptographicA security administrator is deploying full-disk encryption on a fleet of company laptops used by traveling employees. Management is concerned about users choosing weak passwords and about the possibility of an attacker stealing a laptop and attempting to extract encryption keys offline. The administrator wants to use a hardware-based root of trust to protect the disk-encryption keys and support measured boot. Which solution best meets these requirements?
- A
Store the full-disk encryption key in a Trusted Platform Module (TPM) and require a pre-boot PIN
- B
Use a self-signed certificate on each laptop to protect the full-disk encryption key
- C
Hash the users' login passwords with SHA-256 and use those hashes directly as disk-encryption keys
- D
Enable NTFS permissions on the laptops so only authorized users can access encrypted files
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a Trusted Platform Module (TPM) with full-disk encryption and a pre-boot PIN. In real-world enterprise deployments, TPM-backed disk encryption helps protect encryption keys against offline theft and supports platform integrity checks during startup. This aligns with industry best practices for endpoint protection and with guidance from vendors and standards bodies that recommend hardware-backed key storage for device encryption. Measured boot and secure key storage are core cryptographic protections that software-only controls, password hashing alone, certificates alone, or file permissions cannot replace. In practice, technologies such as BitLocker commonly use TPM-based protectors, and security guidance from NIST and platform vendors supports using hardware roots of trust to safeguard cryptographic keys on endpoints.
- A. Correct.
Correct. A TPM is designed to provide hardware-backed key storage and platform integrity measurements. When combined with full-disk encryption, the TPM can protect key material from offline extraction and can help ensure the system boots in a trusted state. Adding a pre-boot PIN strengthens protection by requiring something the user knows in addition to the hardware-based protection, reducing the risk if a device is stolen.
- B. Incorrect.
Incorrect. A self-signed certificate does not provide the hardware-backed protection needed for full-disk encryption keys. Certificates are commonly used for identity, authentication, and encryption in PKI-based scenarios, but simply placing a certificate on the laptop does not create a hardware root of trust or provide measured boot capabilities.
- C. Incorrect.
Incorrect. Password hashes such as SHA-256 outputs are not intended to be used directly as disk-encryption keys in this manner. This reflects a common misconception that hashing alone is a sufficient key-management strategy. Secure full-disk encryption implementations use dedicated key hierarchies, key protectors, and often hardware support such as TPMs rather than reusing password hashes as raw encryption keys.
- D. Incorrect.
Incorrect. NTFS permissions are access-control settings enforced by the operating system after boot and authentication. They do not protect data if an attacker removes the drive and reads it offline, nor do they provide cryptographic key protection or measured boot. This option confuses file system permissions with encryption.