70-411(Efs & Bitlocker)

Front 1

How to do configure a Data Recovery Agent for EFS

Back 1

cipher /r

Add the Data Recovery Agent to the Default Domain Policy

Front 2

is the feature that computer Vista-Up can use a TPM to store cryptographic info such as encryption keys.

Back 2

BitLocker Drive Encryption(BDE)

Front 3

Which Bitlocker mode, stores the Bitlocker volume encryption key on the TPM chip, but an administrator must supply a personal pin and insert a USB flash drive containing a startup key before the system can unlock the Bitlocker volume and complete the boot sequence.

Back 3

"TPM + startup PIN + startup key"

Front 4

Which Bitlocker mode, stores the Bitlocker volume encryption key on the TPM chip, but an administrator must insert a USB flash drive containing a startup key before the system can unlock......

Back 4

"TPM +startup key"

Front 5

Which bitlocker mode store the Bitlocker volume encryption key on the TPM chip, but an Administrator must supply a pin before the system can unlock.....

Back 5

"TPM + startup pin"

Front 6

Which bitlocker mode stores a startup key on a USB flash drive, which the administrator must insert each time the system boots. This mode does not require the server to have a TPM chip, but it must have a system BIOS that supports access to the USB flash drive.

Back 6

Startup key only

Front 7

Which bitlocker mode stores volume encryption key on the TPM chip, and accesses it automatically when the chip has determined that the boot environment is unmodified. This unlocks the protected volume and requires no Administrator interaction.

Back 7

TPM only

Front 8

This features enables users to encrypt removable media USB devices, such as flash drives or external hdds.

Back 8

Bitlocker To Go

Front 9

This allows Bitlocker to be enabled before the operating system is installed, The random encryption key is store on disk unprotected, and after Windows is installed, users can fully protect the encryption key for the volume by activating BitLocker and selecting the Bitlocker unlock method

Back 9

Bitlocker Pre-Provisioning

Front 10

To create a DRA for Bitlocker, what must you do?

Back 10

1.Add the dra account to > COMPUTER CONFIGURATION>POLICIES>WINDOWS SETTINGS>SECURITY SETTINGS>PUBLIC KEY POLICIES>BITLOCKER DRIVE ENCRYPTION....link it to the gpo containing the user or to the system's local security policy(gpedit)

2.Configure the "Provide the unique identifiers for your organization" policy setting in ....>COMPUTER CONFIGURATION>POLICIES>ADMINISTRATIVE TEMPLATES>WINDOWS COMPONENTS>"BITLOCKER DRIVE ENCRYPTION"

3.Enable DRA recovery for each type of Bitlocker resource you want to recover: Ex: OS drives, fixed drives, and removable drives.

Front 11

provides an automatic unlock of operating system volumes at system reboot when connected to a trusted wired corporate network

Back 11

Bitlocker Network-Unlock

Front 12

Bitlocker Network Unlocker Requirements?

Back 12

Windows 8 installation on UEFI firmware with UEFI DHCP drivers

Bitlocker Network Unlock Feature

Windows Server 2012 WDS Role(Network unlock is installed on this server)x.509 certificate

DHCP Server separate from the WDS server and DC

A Network Unlock certificate

Network Unlock Group Policy setting configured

Front 13

cipher /r

Back 13

Generates an EFS recovery agent key and certificate, then writes them to a .pfx file (containing certificate and private key) and a .cer file (containing only the certificate). If /smartcard is specified, it writes the recovery key and certificate to a smart card, and no .pfx file is generated.

Front 14

Get-Certificate

Back 14

cmdlet can be used to submit a certificate request and install the resulting certificate, install a certificate from a pending certificate request, and enroll for ldap

Front 15

What is UEFI?

Back 15

Unified Extensible Firmware Interface

is a standard firmware interface for PCs, designed to replace BIOS (basic input/output system).

UEFI can support remote diagnostics and repair of computers, even without another operating system
Better security by helping to protect the pre-startup—or pre-boot—process against bootkit attacks.

•
Faster startup times and resuming from hibernation.

•
Support for drives larger than 2.2 terabytes (TB).

•
Support for modern, 64-bit firmware device drivers that the system can use to address more than 17.2 billion gigabytes (GB) of memory during startup.

•Capabililty to use BIOS with UEFI hardware.

Note

All 64-bit versions of PCs running Windows with a logo from the Windows Certification Program will use UEFI instead of BIOS. To learn more about your PC's support of UEFI, see the product info that came with your PC.