220-1102 Practice Question: A company's security policy requires that all…

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

Answer analysis

Why the other options are wrong

Understanding why incorrect options are tempting is as important as knowing the correct answer.

• ✗

  Enable Secure Boot in UEFI

  Secure Boot helps ensure that only trusted software loads during boot, but it does not provide the necessary startup key for TPM-less BitLocker.

• ✗

  Disable the TPM requirement via Group Policy

  Disabling the TPM requirement is a necessary prerequisite, but the question asks for the additional step to enable BitLocker. The technician must also configure the startup key after the policy change.

• ✗

  Convert the system partition to GPT

  GPT is required for UEFI boot and BitLocker works with both MBR and GPT, but converting to GPT does not enable TPM-less BitLocker.

Technical deep dive

How to think about this question

BitLocker is Windows' full disk encryption feature, designed to protect data at rest. Its primary and most secure mode of operation relies on a Trusted Platform Module (TPM), a dedicated cryptographic processor that stores the encryption keys and verifies the integrity of the boot process. When a TPM is present, BitLocker automatically unlocks the drive during boot, provided the system's boot components haven't been tampered with. However, not all systems, especially older ones or those not specifically designed for enterprise use, come equipped with a TPM. In such scenarios, BitLocker offers alternative authentication methods to secure the encryption key and allow the system to boot. One of these alternative methods, and the one required in this specific scenario, is the use of a startup key. This key is typically stored on a USB flash drive. When BitLocker is configured without a TPM, the system will prompt the user to insert this USB drive during the boot process. The startup key on the USB drive is then used to unlock the volume encryption key, allowing the operating system to load. This method provides a similar level of protection to a TPM in terms of requiring a physical token for authentication, ensuring that the drive cannot be decrypted and accessed without the presence of this specific USB key. It directly addresses the security requirement of protecting the encryption key when the hardware-based TPM is absent. This approach differs significantly from the distractor options. Enabling Secure Boot in UEFI, while a good security practice, focuses on verifying the integrity of the boot chain and preventing malicious software from loading; it does not provide an alternative mechanism for storing or releasing the BitLocker encryption key itself. Disabling the TPM requirement via Group Policy is a necessary *prerequisite* to even *allow* BitLocker to be configured without a TPM, but it is not the *additional step* that *enables* BitLocker's protection in this mode. Without configuring a startup key (or a password), BitLocker cannot function securely without a TPM. Converting the system partition to GPT is related to modern boot methods (UEFI) and disk partitioning schemes, but it has no direct bearing on how BitLocker handles key management in the absence of a TPM.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

FAQ

Questions learners often ask

Keep practising

More 220-1102 practice questions

• →A change advisory board (CAB) approved a standard change to update antivirus definitions on all servers. The technician…
• →A company's change management policy requires all server changes to be approved by the Change Advisory Board (CAB). A te…
• →A company is implementing a bring-your-own-device (BYOD) policy and needs to ensure that corporate data on employee mobi…
• →A company requires employees to present both a smart card and a PIN to log into their workstations. Which authentication…
• →A company requires all Windows 10 workstations to be able to join an Active Directory domain. Which edition of Windows 1…
• →A company wants to allow employees to securely access internal resources from home via the internet. Which method provid…