Question

A technician is enabling BitLocker on the C: drive of a Windows 11 Pro laptop that has a TPM 2.0 chip. The company policy requires that if the drive is ever moved to another machine or the TPM detects tampering, the data must remain recoverable by IT but not by the end user. Where should the technician store the BitLocker recovery key to best meet this policy?

Accepted Answer

Back up the recovery key to the organization's Active Directory / Azure AD account

Answer

Print the recovery key and tape it to the underside of the laptop

Answer

Save the recovery key to a text file on the same C: drive being encrypted

Answer

Save the recovery key to a USB flash drive kept in the laptop bag