312-50 Question 466
Single answer▪ Disk EncryptionDuring an internal security assessment, you are asked to evaluate whether a company’s full-disk encryption controls adequately protect data on laptops that may be lost or stolen. One Windows 11 laptop uses BitLocker with TPM-only protection enabled, and the organization stores all recovery keys in Active Directory. To demonstrate a realistic attack path, you are given temporary physical access to a powered-off laptop that was previously used by an executive. Which action would MOST likely allow you to obtain access to the encrypted data without knowing the user’s Windows password?
- A
Boot the laptop normally and use a password spraying attack against the Windows login screen until the account is unlocked
- B
Remove the drive and connect it to another computer; because BitLocker is tied to the original OS installation, the drive will automatically decrypt when mounted elsewhere
- C
Perform a cold boot or memory-based attack immediately after the system has been running, attempting to recover BitLocker volume keys from RAM
- D
Query Active Directory anonymously from another host to retrieve the BitLocker recovery key for the executive’s laptop
Show answer and explanation
Correct answer: C
Explanation
The best answer is the memory-based attack. Full-disk encryption primarily protects data at rest, especially against offline attacks such as drive theft. However, once a system has booted and the volume is unlocked, key material may be present in memory. In TPM-only configurations, the machine can boot without additional user-supplied pre-boot authentication, which may increase exposure if an attacker can act while the device is running, recently powered on, or resuming from sleep. Microsoft guidance on BitLocker notes the importance of startup authentication choices, and industry best practices commonly recommend TPM+PIN for higher-risk laptops, along with secure sleep/hibernate policies and protection of recovery keys. The other options confuse OS authentication with disk encryption, assume nonexistent automatic decryption behavior, or rely on unrealistic anonymous access to recovery key storage.
- A. Incorrect.
Incorrect. Password spraying targets account authentication, not the disk encryption layer itself. If the system is powered off and BitLocker has protected the drive, attacking the Windows login alone does not bypass full-disk encryption. In addition, repeated attempts may trigger account lockout or monitoring. This option reflects a common misunderstanding that OS login and disk encryption are the same control.
- B. Incorrect.
Incorrect. BitLocker does not automatically decrypt a protected drive just because it is attached to another computer. In fact, moving the drive to another system is exactly the type of offline theft scenario BitLocker is designed to defend against. Without the proper protector material, such as the recovery key or unlocked volume key, the drive remains encrypted.
- C. Correct.
Correct. A TPM-only BitLocker deployment improves usability, but it is more exposed to attacks that target keys present in system memory after boot or during resume from sleep. If the tester can gain access shortly after the machine has been powered on or resumed, a cold boot or similar memory acquisition technique may allow recovery of encryption material from RAM, potentially enabling access to the disk without the Windows password. This is why organizations often strengthen BitLocker with pre-boot PINs and hibernation controls for high-risk systems.
- D. Incorrect.
Incorrect. Active Directory does not permit anonymous retrieval of BitLocker recovery keys in a properly configured environment. Recovery passwords stored in AD DS are protected and require appropriate privileges to access. While compromise of AD permissions could expose recovery keys, anonymous querying is not a realistic or standard attack path.