156-536 · Question #98
To enforce the FDE policy, the following requirement must be met?
The correct answer is C. Deployments must consist of at least one post-boot user. Option C is correct because FDE (Full Disk Encryption) policy enforcement requires at least one post-boot user to be assigned to a deployment - without a registered user in the pre-boot authentication environment, the encryption agent has no credentials to authenticate against…
Question
To enforce the FDE policy, the following requirement must be met?
Options
- AThe client must obtain an FDE machine-based policy
- BThe client must obtain an FDE certificate
- CDeployments must consist of at least one post-boot user
- DA recovery file must be encrypted
How the community answered
(26 responses)- A4% (1)
- B4% (1)
- C92% (24)
Explanation
Option C is correct because FDE (Full Disk Encryption) policy enforcement requires at least one post-boot user to be assigned to a deployment - without a registered user in the pre-boot authentication environment, the encryption agent has no credentials to authenticate against, making enforcement impossible. This is a fundamental architectural requirement: the pre-boot authentication phase depends on user accounts being present to unlock the encrypted drive at startup.
Why the distractors are wrong:
- A - A machine-based policy alone is insufficient; user presence in the pre-boot environment is still required for the policy to activate.
- B - FDE enforcement does not require a separate FDE-specific certificate; authentication is handled through the assigned post-boot user credentials.
- D - A recovery file must exist for recovery purposes, but it does not need to be encrypted itself as a prerequisite to enforcing the FDE policy.
Memory tip: Think "no user, no enforcement" - FDE can't lock a door if nobody has a key registered. The post-boot user is the key.
Topics
Community Discussion
8
Ola B.Apr 20, 2026Option C is correct. FDE enforcement requires at least one post-boot user because the OS needs a valid user credential to unlock the encrypted drive after startup, and without that post-boot user defined in the deployment the policy simply has nothing to authenticate against and cannot complete the boot sequence.
Orla P.Apr 23, 2026That tracks for policies requiring a user-based key protector, but worth pointing out that a TPM-only BitLocker setup decrypts at boot with no post-boot user involved at all, so the real test point is that this specific policy configuration demands user authentication, not that FDE in general can't function without one.
Orla P.May 11, 2026C is right. FDE enforcement requires at least one post-boot user to be defined because the policy cannot activate without a valid user account that authenticates after the initial boot sequence completes.
Samuel O.May 8, 2026Saw something worded almost exactly like this on my actual exam and almost talked myself into B because I kept thinking "certificate" sounded official enough to be a policy enforcement mechanism, but two decades of rolling out endpoint security taught me that FDE lives or dies on who can authenticate after the machine boots, so C was the only answer that made operational sense. Post-boot user requirement is the whole point, otherwise you've encrypted a drive nobody can unlock in the field.
Amara A.Apr 25, 2026Going with A on this one and I feel pretty solid about it. The whole enforcement chain in Endpoint Security starts at the policy layer, and FDE is no different, the blade will not activate encryption until the client has actually received and applied a valid FDE machine-based policy from the management server. If you think about how SmartConsole pushes policy down, the machine object has to be bound to that policy package, otherwise the client has nothing to enforce against regardless of what else is configured on it. The other options describe supporting elements or post-setup conditions, but none of them are the gating requirement that actually triggers enforcement, that gate is the machine-based policy acquisition. Certificate, recovery file, post-boot users, all of that comes after the client has the policy in hand and knows what it is supposed to do.
Orla P.Apr 28, 2026Amara, the policy is necessary but it is not the gate, the client will not begin encrypting until at least one preboot user has been defined on the machine, which is what C is describing. Without that preboot user in place, FDE has no authentication factor to unlock the drive at boot, so Check Point holds off on starting encryption regardless of policy delivery.
Ingrid P.May 20, 2026A is the one I have drilled into a card and I will stake my review queue on it. The machine-based policy is the enforcement mechanism itself, and without the client obtaining that policy the FDE requirement simply has no lever to act on, so every other option is downstream noise.
Orla P.May 23, 2026Ingrid, the policy reaching the client is just delivery, not enforcement, and C is correct because the actual lever is the compliance evaluation that flags the device as non-compliant and triggers remediation when encryption is absent. Without that evaluation step firing, the policy sitting on the machine does nothing on its own.