StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Storage and file services · Storage and file services | Configure Windows Server storage

Practice question 301 of 506 · medium

When responding to an encrypted-volume incident, select two correct actions.

Select all that apply. Every correct option and no extras are required for credit in the app.

  1. A.Assume an unexpected RAW state proves BitLocker is the sole cause
  2. B.Identify whether the failing layer is BitLocker, EFS or underlying storage
  3. C.Assume clearing the TPM recovers missing encryption keys
  4. D.Treat every recovery as a reason to disable protection permanently
  5. E.Use matching authorized recovery material and preserve source evidence
Show the answer and explanation

✓ Correct answers

  • Identify whether the failing layer is BitLocker, EFS or underlying storage
  • Use matching authorized recovery material and preserve source evidence

Classifying the layer and preserving matching key material support correct recovery. TPM clearing does not recreate lost keys; RAW can be storage/filesystem damage; permanent disablement does not investigate the trigger.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.