Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

MD 102 > Disk Encryption policy for Windows devices > Flashcards

Disk Encryption policy for Windows devices Flashcards

(46 cards)

Start Studying
1
Q

What is the first policy type to configure encryption on managed devices?

A

Endpoint security > Windows encryption policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the two profiles available under the Windows encryption policy?

A
  • BitLocker
  • Personal Data Encryption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How does Personal Data Encryption (PDE) differ from BitLocker?

A

PDE encrypts files instead of whole volumes and disks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

When does BitLocker release data encryption keys?

A

At boot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

When does Personal Data Encryption (PDE) release data encryption keys?

A

Until a user signs in using Windows Hello for Business

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the second policy type for configuring encryption on managed devices?

A

Device configuration profile for endpoint protection for BitLocker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What settings are included in the device configuration profile for endpoint protection?

A

BitLocker settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What Windows versions support BitLocker settings in endpoint protection?

A

Windows 10/11

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the 3 RBAC roles to manage Bitlocker?

A
  • Help Desk Operator
  • Endpoint Security Administrator
  • Global Admin
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the 6 steps to create an endpoint security policy for Windows and deploy Bitlocker ?

A
  1. Endpoint security > Disk encryption > Create Policy
  2. Platform: Windows
  3. Profile: Choose either BitLocker or Personal Data Encryption
  4. Configuration settings
  5. Scope tags
  6. Assignments
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

In an endpoint security policy for Windows to deploy Bitlocker, what are the 5 configuration settings options ?

A
  • BitLocker
  • BitLocker Drive Encryption
  • Operating System Drives
  • Fixed Data Drives
  • Removable Data Drives
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the 3 key components included in BitLocker option in configuration settings in endpoint security policy ?

A
  • Require Device Encryption,
  • Allow Warning for Other Disk Encryption,
  • Configure Recovery Password Rotation

These components help manage encryption settings and recovery options in BitLocker.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

2

What does BitLocker Drive Encryption option in configuration settings in endpoint security policy allow you to choose?

A
  • Drive encryption method and cipher strength,
  • Unique identifiers for your organization

This customization ensures that the encryption meets organizational security standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the 3 enforcement options for Operating System Drives in BitLocker, in configuration settings in endpoint security policy ?

A
  • Enforce drive encryption type,
  • Require additional authentication at startup,
  • Choose recovery methods

These options enhance security and recovery processes for operating system drives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

2

In configuration settings in endpoint security policy, what can be enforced for Fixed Data Drives using BitLocker?

A
  • Enforce drive encryption type,
  • Choose recovery methods

This ensures that fixed data drives are protected according to organizational policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What control does BitLocker provide for Removable Data Drives, in configuration settings in endpoint security policy?

A

Control use of BitLocker on removable drives

This allows organizations to manage encryption settings for portable storage devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the 6 steps to create an endpoint security policy for Windows and deploy Bitlocker ?

A
  1. Devices > Manage devices > Configuration > On the Policies tab, select Create
  2. Platform: Windows
  3. Profile: Select Templates > Endpoint protection
  4. Configuration settings, expand Windows Encryption.
  5. Scope tags
  6. Assignments
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the most secure combination of authentication methods for unlocking a drive?

A

TPM + startup PIN + startup key

This combination is considered the most secure as it requires multiple authentication tasks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which authentication method requires the user to insert a USB flash drive containing a startup key?

Study These Flashcards
A

TPM + startup key

In this method, the encryption key is stored on the TPM chip.

20
Q

What does the TPM + startup PIN method require from the user?

Study These Flashcards
A

Entering a PIN

The encryption key is stored on the TPM chip.

21
Q

What is needed for the startup key only method?

Study These Flashcards
A

Insert a USB flash drive with the startup key

This method does not require a TPM chip, but the BIOS must support USB access before the OS loads.

22
Q

What does the TPM only method require from the user?

Study These Flashcards
A

No user action is required

The encryption key is stored on the TPM chip.

23
Q

True or False: The startup key only method requires a TPM chip.

Study These Flashcards
A

False

The device does not need to have a TPM chip for this method.

24
Q

What happens to a BitLocker encrypted drive until it is unlocked?

Study These Flashcards
A

The drive is encrypted.

25
What are the two methods to unlock a BitLocker encrypted drive in recovery mode?
* Recovery password * Recovery key
26
What is a recovery password in BitLocker?
A 48-digit number typed on a regular keyboard or using function keys (F1-F10).
27
What is a recovery key in BitLocker?
An encryption key created when BitLocker is first employed for recovering data encrypted on a BitLocker volume.
28
# 2 steps How to rotate the BitLocker recovery key ?
1.Select **Devices** > **All devices** 2. Select a **device**, and then **select the BitLocker key rotation remote action**.
29
What does Intune enable for end users regarding recovery keys?
Self-service scenarios through Company Portal (website or app) ## Footnote This allows users to obtain their recovery keys without calling the helpdesk.
30
Where are BitLocker recovery keys stored when using Intune?
Within Entra ID ## Footnote This storage is essential for managing recovery key access.
31
What is the default setting for the tenant-wide toggle preventing recovery key access for non-admin users?
'No' ## Footnote This allows all users to recover their BitLocker keys.
32
What happens when the tenant-wide toggle preventing recovery key access for non-admin users is set to 'Yes'?
Restricts non-admin users from seeing their BitLocker keys ## Footnote This means only admins can access the keys for their devices.
33
What do Audit Logs within the Entra ID portal track?
History of activities related to recovery key access ## Footnote This includes logs for user recovery key accesses made through the Company Portal.
34
What category are recovery key accesses logged under in Audit Logs?
Key Management ## Footnote This categorization helps in organizing logs related to key access.
35
What information is logged when a user accesses a recovery key?
User Principal Name and key ID ## Footnote This information aids in tracking who accessed the key.
36
What can you set as an Entra Conditional Access policy to access BitLocker Recovery Key?
Require a compliant device ## Footnote This ensures that only devices meeting compliance requirements can access sensitive resources.
37
True or False: A device that fails to meet compliance requirements can access the BitLocker Recovery Key.
False ## Footnote Such devices are considered non-compliant and cannot access corporate resources.
38
Fill in the blank: The access to certain corporate resources is restricted by the __________ policy.
Conditional Access ## Footnote This policy helps manage resource access based on device compliance.
39
What must users enter if BitLocker does not unlock their operating system drive?
A recovery key
40
Where can BitLocker recovery keys be stored and accessed?
Using Intune
41
What is the first step to access the BitLocker key for a user in Intune?
Navigate to Devices and select Windows devices
42
After selecting the device in Intune, what should you select next to access recovery keys?
Recovery keys
43
What should you do in the details pane to show the recovery key?
Select Show Recovery Key
44
Besides Intune, where else can you access the BitLocker recovery key?
From Entra ID
45
In Entra ID, what must you select to access BitLocker keys?
The appropriate device from All devices
46
Fill in the blank: To access BitLocker keys in Intune, you must navigate to _______.
Devices and select Windows devices

MD 102 (74 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions