AZ-801 · Question #19
You need to implement BitLocker Drive Encryption (BitLocker) on Server4. Whenever possible, use the principle of least privilege. To which group in Contoso.com should you add User1?
The correct answer is A. Domain Admins. To implement BitLocker on a server, a user generally requires local administrator privileges, and in a domain environment, Domain Admins have the necessary permissions across domain-joined servers.
Question
Options
- ADomain Admins
- BAccount Operators
- CSchema Admins
- DBackup Operators
How the community answered
(30 responses)- A77% (23)
- B13% (4)
- C3% (1)
- D7% (2)
Why each option
To implement BitLocker on a server, a user generally requires local administrator privileges, and in a domain environment, Domain Admins have the necessary permissions across domain-joined servers.
Implementing BitLocker, especially managing it remotely or configuring its recovery options (like storing recovery keys in Active Directory), typically requires administrative privileges on the target server. Membership in the Domain Admins group grants full administrative control over all domain-joined computers, including Server4, making it sufficient for BitLocker implementation.
Account Operators can manage user and group accounts in the domain but do not have administrative privileges on servers required to enable BitLocker.
Schema Admins can modify the Active Directory schema, a highly privileged role unrelated to enabling BitLocker on a server.
Backup Operators can back up and restore files on all domain controllers and member servers but do not have the necessary permissions to configure BitLocker encryption.
Concept tested: BitLocker implementation permissions
Source: https://learn.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-manage-bitlocker-with-ad-ds
Topics
Community Discussion
No community discussion yet for this question.