SC-100 Design security solutions for infrastructure Practice Question
Your organization is implementing a security baseline for Windows 11 devices using Microsoft Intune. You need to ensure that BitLocker encryption is enabled on all devices and that recovery keys are stored in Microsoft Entra ID. Which policy type should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Endpoint security policy for disk encryption.
The correct option is B, an Endpoint security policy for disk encryption, because in Intune this policy type is purpose-built to configure BitLocker on Windows 11 and includes the setting to back up recovery keys to Microsoft Entra ID (the 'Save BitLocker recovery information to Microsoft Entra ID' option). It directly enforces encryption at the OS volume and manages key escrow to Entra ID, which is exactly the baseline requirement. Option A (administrative templates) can configure some BitLocker settings but is not the dedicated disk-encryption workload and lacks the streamlined recovery-key-to-Entra ID escrow flow. Option C (update rings) only controls Windows quality/feature update deferrals and has nothing to do with encryption. Option D (compliance policy for device encryption) only evaluates and reports whether a device is encrypted; it does not enable BitLocker or store recovery keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Device configuration profile for administrative templates.
Why it's wrong here
Administrative templates (ADMX-backed) in a device configuration profile can bake BitLocker settings like requiring device encryption or setting cipher strength, but they are a sprawling, generic mechanism that lacks the focused management and reporting of the dedicated security policy. For a security baseline, Microsoft recommends using the endpoint security disk encryption policy instead, which provides tailored BitLocker configuration and recovery key handling. This option may work technically but is not the preferred, baseline-aligned choice.
- ✓
Endpoint security policy for disk encryption.
Why this is correct
Endpoint security policy for disk encryption is the correct approach because it consolidates all BitLocker controls — encryption method, XTS-AES cipher strength, TPM protector usage, and recovery key escrow to Entra ID — into a single, purpose-built policy type. Unlike compliance checks or ADMX templates, it actively configures BitLocker and can enforce encryption silently on target Windows devices. It aligns directly with Microsoft's security baseline guidance and provides clear status reporting in the security center.
- ✗
Update rings for Windows 10 and later.
Why it's wrong here
Update rings for Windows 10 and later are designed to manage the rollout of Windows quality and feature updates through Windows Update for Business, including deferral periods and maintenance windows. They contain no mechanism to enable or configure BitLocker or any other disk-encryption setting, so they cannot implement a disk-encryption security baseline. While updates might patch BitLocker vulnerabilities, that is incidental and not a configuration control for encryption policies.
- ✗
Compliance policy for device encryption.
Why it's wrong here
A compliance policy for device encryption is a gate-check that assesses whether a device is already encrypted, for example by running the encryption check on the OS drive and reporting the result as compliant or noncompliant. It never provisions BitLocker settings, does not set recovery-key escrow, and cannot force-encrypt a device that is currently unencrypted. Therefore, compliance policies are useful for visibility and conditional access only, not as the mechanism that configures the baseline.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 605-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A small business uses Microsoft 365 Business Premium and wants to secure their Windows 10 devices with Microsoft Intune. They need to ensure that only devices compliant with the company's security policies can access corporate email. What should they configure?
easy- A.Azure AD Application Proxy
- B.Windows Defender Firewall rules
- C.Microsoft Defender for Cloud Apps session policy
- ✓ D.Conditional Access policy requiring compliant device
Why D: Conditional Access in Microsoft Entra ID can require device compliance before granting access to Exchange Online. Device compliance policies in Intune define the security requirements. Azure AD Application Proxy is for on-prem apps. Microsoft Defender for Cloud Apps is for cloud app security. Windows Defender Firewall is for network security.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.