Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

MSCA 70-411 > Configure file and disk encryption > Flashcards

Configure file and disk encryption Flashcards

1
Q

TPM

A

Trusted platform module

Cryptography specification and name of the chip used in PC hardware to allow for Bitlocker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Bitlocker is available in what editions of Windows desktop

A

Windows Vista / 7 Ultimate
Windows Vista / 7 Enterprise
Windows Pro 8
Windows Enterprise 8

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

First server version to have bitlocker

A

Server 2008

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

FDE

A

Full Disk Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Bitlocker

A

software-based full disk encryption data-protection security features.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Bitlocker is available in what editions of Server 2012

A

All of them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Bitlocker To Go

A

Data on a USB device is encrypted.

Bitlocker exe is put on the drive and requires a password to access the data on the drive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Five Bitlocker implementation

A 
TPM
USB
TPM+USB
TPM+PIN
TPN+PIN+USB

Note that this means Bitlocker does not need a TPM chip to store a trusted key. You can use the USB instead

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

TPM chip does what for Bitlcoker

A

Preboot execution security
Confirms that hardware has not been tampered with
Confirms that files were not accessed while PC was off

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

USB instead of TPM for Bitlocker

A

You must always have the USB plugged in, to even turn on…

You can simulate the TPM chip with the USB device.
One downside: You can’t detect system integrity / confirm there was no hardware tampering, or that files weren’t accessed from the HD while the PC was off.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Recovery Key

A

Optional key to use in the event that you lose the TPM chip (hardware failure) or the USB or any other requirement (PIN) to boot.

For emergencies.

Can be password, key stored on USB, can be printed, or distributed via Group Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

BL requirements to use TPM

A

TPM 1.2 or 2.0
TCG-compliant BIOS or UEFI firmware
Support for USB mass storage devices
separate partition on the drive just for data that’s encrypted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

EPS

A

Encrypted File System

Allows users to right-click a file , open properties, and encrypt files / folders.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Add-BitLockerKeyProtector

A

Adds a key protector for a BitLocker volume.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Backup-BitLockerKeyProtector

A

Saves a key protector for a BitLocker volume in AD DS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Clear-BitLockerAutoUnlock

A

Removes BitLocker automatic unlocking keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Disable-BitLocker

A

Disables BitLocker encryption for a volume.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Disable-BitLockerAutoUnlock

A

Disables automatic unlocking for a BitLocker volume.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Enable-BitLocker

A

Enables encryption for a BitLocker volume.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Enable-BitLockerAutoUnlock

A

Enables automatic unlocking for a BitLocker volume.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Get-BitLockerVolume

A

Gets information about volumes that BitLocker can protect.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Lock-BitLocker

A

Prevents access to encrypted data on a BitLocker volume.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Remove-BitLockerKeyProtector

A

Removes a key protector for a BitLocker volume.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Resume-BitLocker

A

Restores Bitlocker encryption for the specified volume.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Suspend-BitLocker

A

Suspends Bitlocker encryption for the specified volume.

26
Q

Unlock-BitLocker

A

Restores access to data on a BitLocker volume.

27
Q

Bitlocker implementation: TPM

A

Use just the TPM chip, which stores encryption keys and can detect hardware tampering and HD access while hardware is offline

28
Q

Bitlocker implementation: USB

A

USB stick simulates the TPM chip. Provides encryption keys but does not detect hardware tampering or HDC access while hardware is offline

29
Q

Bitlocker implementation: TPM+USB

A

TPM does what the TPM does (encryption, tamper detect) AND you require a USB stick just to boot the PC.

30
Q

Bitlocker implementation:TPM+PIN

A

TPM does what the TPM does (encryption, tamper detect) AND you require a PIN just to boot the PC.

31
Q

Bitlocker implementation:TPN+PIN+USB

A

TPM does what the TPM does (encryption, tamper detect) AND you require a PIN and the USB stick to boot the pc.

32
Q

What version will allow you to store the recovery key in your .NET Passport account?

A

w8

This means the key is stored in the cloud

33
Q

What are the hard disk requirements for BitLocker?

A

You need two disks, or one disk with two partition.
The boot / system volume cannot be encrypted.
The OTHER volume, with the OS and your encrypted data, is encrypted.

34
Q

BitLocker Network Unlock

A

A service that allows PCs resuming from hibernation or rebooting to forgo the entering of a PIN on those startups if you use TPM + PIN or USB + PIN.

35
Q

Bitlocker Network Unlock is available as of

A

Windows 8

Server 2012

36
Q

Bitlocker Network Unlock requires clients to have what drivers

A

UEFI DHCP drivers

37
Q

What server requirements are there for BitLocker Network Unlock?

A

The service must be installed on Server 2012
It must be on a server with WDS role installed
There must be a seperate DHCP server
You must have a properly configured public/private key pairing
You must select clients via group policy

38
Q

UEFI

A

Unified Extensible Firmware Interface

Next generation for BIOS

39
Q

manage-bde: status

A

Provides information about all drives on the computer, whether or not they are BitLocker-protected.

40
Q

manage-bde: on

A

Encrypts the drive and turns on BitLocker.

41
Q

manage-bde: off

A

Decrypts the drive and turns off BitLocker. All key protectors are removed when decryption is complete.

42
Q

manage-bde: pause

A

Pauses encryption or decryption.

43
Q

manage-bde: resume

A

Resumes encryption or decryption.

44
Q

manage-bde: lock

A

Prevents access to BitLocker-protected data.

45
Q

manage-bde: unlock

A

Allows access to BitLocker-protected data with a recovery password or a recovery key.

46
Q

manage-bde: autounlock

A

Manages automatic unlocking of data drives.

47
Q

manage-bde: protectors

A

Manages protection methods for the encryption key.

48
Q

manage-bde: tpm

A

Configures the computer’s Trusted Platform Module (TPM). This command is not supported on computers running Windows 8 or win8_server_2. To manage the TPM on these computers, use either the TPM Management MMC snap-in or the TPM Management cmdlets for Windows PowerShell.

49
Q

manage-bde: setidentifier

A

Sets the drive identifier field on the drive to the value specified in the Provide the unique identifiers for your organization Group Policy setting.

50
Q

manage-bde: forcerecovery

A

Forces a BitLocker-protected drive into recovery mode on restart. This command deletes all TPM-related key protectors from the drive. When the computer restarts, only a recovery password or recovery key can be used to unlock the drive.

51
Q

manage-bde: changepassword

A

Modifies the password for a data drive.

52
Q

manage-bde: changepin

A

Modifies the PIN for an operating system drive.

53
Q

manage-bde: changekey

A

Modifies the startup key for an operating system drive.

54
Q

manage-bde: keypackage

A

Generates a key package for a drive.

55
Q

manage-bde: upgrade

A

Upgrades the BitLocker version.

56
Q

manage-bde: WipeFreeSpace

A

Wipes the free space on a drive.

57
Q

EFS

A

Older alternative to BitLocker

Encrypting File System

58
Q

EFS encryption is based on

A

The local user’s password.

Changing the password can invalidate that cert

59
Q

EFS encryption for domains is based on

A

2 or more keys.
1st – the user’s key / agent
2nd – The domain’s recovery key / agent, set by group policy

This enables Admins to recover data if the user’s key is lost.

60
Q

best practices for EFS

A

keep multiple recovery agents
encrypt folders, not files
export keys from AD so there’s a backup

61
Q

Why should you encrypt folders, not files, for EFS

A

If you encrypt just the file, and not the folder containing the file, when users open the file Windows creates a clear-text copy of that file (it does this always, not just for bitlocker. That ~filename.doc) which will not be encrypted.

MSCA 70-411 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions