SY0-701 Question 175
Single answerEase of deploymentA security administrator must quickly deploy full-disk encryption to 500 company laptops used by remote employees. The company has limited IT staff, and users are spread across multiple time zones. Management wants a solution that is secure but also easy to deploy and manage at scale with minimal user interaction. Which of the following approaches BEST meets this requirement?
- A
Enable BitLocker centrally through Group Policy and use TPM-backed protection with recovery keys escrowed to Active Directory or Azure AD
- B
Require each user to manually install a third-party encryption product and select their own passphrase during setup
- C
Ship all laptops back to headquarters so IT staff can configure BIOS passwords and install encryption locally before redeployment
- D
Use EFS to encrypt each user's Documents folder and instruct users to manually back up their encryption certificates
Show answer and explanation
Correct answer: A
Explanation
The key concept is ease of deployment in a real enterprise security scenario. When an organization needs to roll out security controls quickly across many remote systems, centralized, policy-based technologies are usually preferred because they reduce administrative overhead, improve consistency, and limit user error. Full-disk encryption is commonly deployed using Microsoft BitLocker in Windows enterprise environments, especially when integrated with TPM for secure key storage and with centralized recovery-key escrow in Active Directory or Azure AD. This aligns with vendor best practices for scalable deployment and recovery management. The other options are less suitable because they rely on manual user action, require physical device handling, or do not provide full-disk encryption. From a Security+ perspective, the best solution is the one that balances security effectiveness with operational practicality and ease of deployment.
- A. Correct.
This is the best answer because it combines strong security with ease of deployment and centralized management. BitLocker supports enterprise-scale deployment through Group Policy, Microsoft Intune, and similar management tools. Using the TPM reduces user burden because the device can protect encryption keys in hardware, and escrowing recovery keys to Active Directory or Azure AD supports recovery and compliance. This approach minimizes manual steps, which is critical when supporting a large remote workforce with limited IT staff.
- B. Incorrect.
This is incorrect because requiring users to install and configure encryption themselves increases the chance of deployment errors, inconsistent settings, weak passphrases, and help desk calls. While third-party encryption products may be valid in some environments, the scenario emphasizes ease of deployment at scale and minimal user interaction. Manual end-user setup is not the most efficient or reliable approach.
- C. Incorrect.
This is incorrect because it creates major logistical overhead, delays deployment, and increases cost. Although hands-on configuration may seem thorough, it does not align with the requirement for quick deployment to a distributed remote workforce. Ease of deployment in enterprise environments generally favors centralized, remote, policy-driven solutions over physically recalling hardware.
- D. Incorrect.
This is incorrect because EFS encrypts files and folders rather than the entire drive. The scenario specifically calls for full-disk encryption. In addition, relying on users to manually back up encryption certificates introduces administrative complexity and recovery risk. EFS may protect data at the file level, but it is not the best fit for simple, large-scale full-disk encryption deployment.