SY0-701 Question 176
Single answerEase of deploymentA security administrator at a growing company must roll out full-disk encryption to 600 Windows laptops within two weeks. The company has a small IT staff, and executives want the solution deployed with the least manual effort while still maintaining centralized policy enforcement and recovery key management. Which approach BEST meets these requirements?
- A
Configure BitLocker manually on each laptop through the local Control Panel
- B
Use a Group Policy-based BitLocker deployment integrated with Active Directory escrow for recovery information
- C
Require users to install a third-party encryption tool themselves and email recovery keys to the help desk
- D
Encrypt only executive laptops first and defer all other systems until the next hardware refresh
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use a centralized, policy-driven deployment method that reduces manual configuration while maintaining administrative control. In a Windows enterprise environment, BitLocker can be deployed and enforced through Group Policy, and recovery keys can be escrowed to Active Directory for secure centralized management. This directly supports ease of deployment, consistency, and recoverability at scale. Microsoft enterprise guidance for BitLocker management emphasizes centralized policy enforcement and recovery key backup rather than manual or user-managed approaches. From a Security+ perspective, ease of deployment often involves selecting controls that are practical to implement broadly without sacrificing security or manageability.
- A. Incorrect.
This is incorrect because manually enabling BitLocker on each endpoint does not scale well for 600 laptops and creates a significant administrative burden. It also increases the likelihood of inconsistent settings, missed systems, and errors in recovery key handling. Someone might choose this because BitLocker is built into Windows and is a valid encryption technology, but the question specifically emphasizes ease of deployment and centralized management.
- B. Correct.
This is correct because using Group Policy to deploy and enforce BitLocker settings allows the organization to apply encryption consistently across many domain-joined Windows systems with minimal hands-on effort. Storing BitLocker recovery information in Active Directory supports centralized recovery key management, which aligns with operational and security best practices. This approach is commonly recommended in enterprise Windows environments because it balances strong security with efficient rollout and administration.
- C. Incorrect.
This is incorrect because user-driven installation creates inconsistent deployment, weak oversight, and a high chance of implementation errors. Emailing recovery keys to the help desk is also insecure and difficult to manage compared with centralized escrow. A candidate might pick this option thinking it reduces IT workload, but in practice it increases support burden and weakens governance.
- D. Incorrect.
This is incorrect because limiting deployment to a subset of users does not address the stated requirement to deploy encryption broadly and quickly. Deferring the rest until a future hardware refresh leaves the majority of laptops unprotected and does not satisfy the business need for an immediate, scalable rollout. This option may seem operationally convenient, but it fails both the deployment and security objectives.