nerdexam
Microsoft

AZ-801 · Question #132

Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the accounts shown in the following table. Name | Account type | In…

This question tests knowledge of where BitLocker recovery keys are stored in Active Directory - specifically on which computer object the key is saved, and whether moving a computer or a drive affects that association.

Secure Windows Server on-premises and hybrid infrastructures

Question

Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the accounts shown in the following table.
NameAccount typeIn organizational unit (OU)
Admin1UserOU1
Admin2UserOU2
Server1ComputerOU3
Server2ComputerOU4
The domain is configured to store BitLocker recovery keys in Active Directory. Admin1 and Admin2 perform the following configurations.
  1. Admin1 turns on BitLocker Drive Encryption (BitLocker) for volume C on Server1.
  2. Admin1 moves Server1 to OU1.
  3. Admin2 turns on BitLocker for removable volume E on Server2.
  4. Admin2 moves removable volume E from Server2 to Server1 and unlocks the volume.
On which Active Directory object can you view each BitLocker recovery key? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Explanation

This question tests knowledge of where BitLocker recovery keys are stored in Active Directory - specifically on which computer object the key is saved, and whether moving a computer or a drive affects that association.

Approach. BitLocker recovery keys stored in AD DS are always saved to the computer object of the machine that was active when BitLocker was enabled - not the OU the computer currently resides in, and not where the volume physically is later. For Volume C on Server1: BitLocker was enabled while Server1 was in OU3, but after Admin1 moved Server1 to OU1, the recovery key travels with the Server1 computer object - so the key is viewable on the Server1 object now located in OU1. For removable Volume E: Admin2 enabled BitLocker while the drive was attached to Server2 (in OU4), so the recovery key was written to Server2's computer object in OU4 - moving the physical drive to Server1 afterward does not move the recovery key; it stays on Server2's AD object.

Concept tested. BitLocker recovery key storage in Active Directory: keys are bound to the computer object at the time of encryption, not at the time of viewing or after any subsequent moves of either the computer account or the physical volume.

Reference. Microsoft Docs - 'BitLocker recovery keys and Active Directory Domain Services'; MS-900 / SC-300 / AZ-800 exam domains covering BitLocker and AD DS integration

Topics

#BitLocker#Active Directory#Recovery Keys#Computer Objects

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-801 Practice