You need to configure BitLocker on Server4. On which volumes can you turn on BitLocker, and on which volumes can you turn on auto-unlock? To answer, select the appropriate options in the answer…

Question

Explanation

This question tests knowledge of BitLocker Drive Encryption rules on Windows Server - specifically which volume types support BitLocker encryption and which support the auto-unlock feature.

Approach. BitLocker can be enabled on the OS volume (e.g., C:) and fixed data volumes (e.g., D:, E:). Auto-unlock, however, can only be enabled on fixed data volumes - NOT on the OS volume. This is because auto-unlock works by storing the volume's encryption key protector in the metadata of the BitLocker-protected OS drive; the OS drive itself must already be BitLocker-encrypted before auto-unlock can be configured on any data volume. Removable drives (USB, etc.) support BitLocker To Go but auto-unlock for removable drives is stored per-machine and is a separate mechanism. In a typical exam scenario: the OS volume gets BitLocker turned ON but NOT auto-unlock; data volumes get both BitLocker turned ON and auto-unlock enabled.

Concept tested. BitLocker volume eligibility rules: distinguishing between volumes that support BitLocker encryption (OS + fixed data volumes) versus volumes that support auto-unlock (fixed data volumes only, never the OS volume), and understanding that auto-unlock depends on the OS drive being BitLocker-protected first.

Reference. MS Docs: BitLocker overview and requirements - docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-overview; AZ-800 / 70-744 Securing Windows Server exam objectives

No community discussion yet for this question.