Microsoft 70-646 Online Practice Questions and Exam Preparation

Microsoft 70-646 Online Questions & Answers

• Question 51:

  You need to recommend a monitoring solution for App1 that meets the museum's technical requirements.

  What should you include in the recommendation?

  A. event subscriptions
  B. Microsoft SharePoint Foundation 2010 alerts
  C. Microsoft System Center Operations Manager 2007 R2 and the SMTP service
  D. Resource Monitor
  A. event subscriptions

  ---

  http://technet.microsoft.com/en-us/library/cc749183.aspx

  Event Viewer enables you to view events on a single remote computer. However, troubleshooting an issue might require you to examine a set of events stored in multiple logs on multiple computers.

  Windows Vista includes the ability to collect copies of events from multiple remote computers and store them locally. To specify which events to collect, you create an event subscription. Among other details, the subscription specifies exactly

  which events will be collected and in which log they will be stored locally. Once a subscription is active and events are being collected, you can view and manipulate these forwarded events as you would any other locally stored events.

  Using the event collecting feature requires that you configure both the forwarding and the collecting computers.

  The functionality depends on the Windows Remote Management (WinRM) service and the Windows Event Collector (Wecsvc) service. Both of these services must be running on computers participating in the forwarding and collecting

  process. To learn about the steps required to configure event collecting and forwarding computers, see Configure Computers to Forward and Collect Events.

• Question 52:

  You are planning to upgrade the client computers of the users in the sales department to Windows 7. You need to recommend an upgrade solution to ensure that the client computers can run App2. What should you include in the recommendation?

  A. Internet Explorer Administration Kit (IEAK)
  B. Microsoft Application Compatibility Toolkit (ACT)
  C. Microsoft Application Virtualization (AppV)
  D. Microsoft Enterprise Desktop Virtualization (MED-V)
  D. Microsoft Enterprise Desktop Virtualization (MED-V)

  ---

  http://technet.microsoft.com/en-us/library/ff433573.aspx MED-V uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization. With MED-V, you can easily create, deliver, and manage corporate Virtual PC images on any Windows?based desktop. MED-V is an integral component of the Microsoft Desktop Optimization Pack, a dynamic solution available to Software Assurance customers, which helps reduce application deployment costs, enables delivery of applications as services, and

  helps to better manage and control enterprise desktop environments.

• Question 53:

  You need to recommend a VPN solution for the new sales office. The solution must support the company's planned changes. What should you include in the recommendation?

  A. Internet Key Exchange version 2 (IKEv2)
  B. Layer 2 Tunneling Protocol (L2TP)
  C. PointtoPoint Tunneling Protocol (PPTP)
  D. Secure Socket Tunneling Protocol (SSTP)
  D. Secure Socket Tunneling Protocol (SSTP)

  ---

  http://support.microsoft.com/kb/947032

  SSTP is a new kind of Virtual Private Networking (VPN) tunnel that is available in the Routing and Remote Access Server role in Windows Server 2008. SSTP allows for Point-to-Point Protocol (PPP) packets to be encapsulated over HTTP.

  This allows for a VPN connection to be more easily established through a firewall or through a Network Address Translation (NAT) device. Also, this allows for a VPN connection to be established through an HTTP proxy device.

  The information is this article is more likely to apply to a small-sized or medium-sized organization.

  For these kinds of organizations, it is common to have one public IP address that is assigned to the external interface of a NAT router or of a gateway device. This article describes the following scenario:

  You have a Windows Server 2008-based Secure Socket Tunneling Protocol (SSTP)-based VPN server.

  The server is assigned a private IP address.

  The server is located on an internal network behind a NAT device.

• Question 54:

  You need to recommend a strategy for the computer lab that meet the company's technical requirements. What should you recommend?

  A. Enable the loopback setting in GPO2. Enable the Enforced option in GPO1.
  B. Enable the Block Inheritance option on Lab OU. Enable the Enforced option in GPO1.
  C. Enable the loopback setting in GPO2. Disable the user configuration settings in GPO3.
  D. Enable the Block Inheritance option on Lab OU. Disable the user configuration settings in GPO3.
  D. Enable the Block Inheritance option on Lab OU. Disable the user configuration settings in GPO3.

  ---

  To apply the settings of a Group Policy object (GPO) to the users and computers of a domain, site, or organizational unit, you can link that domain site or organizational unit to that GPO. You can add one or more GPO links to each domain,

  site, and organizational unit in Group Policy Management Console. The settings deployed by GPOs linked to higher containers (parent container) in Active Directory are inherited by default to child containers and combine with any settings

  deployed in GPOs linked to child containers. If multiple GPOs attempt to set a setting to conflicting values, the GPO with the highest precedence sets the setting. GPO processing is based on a last writer wins model, and GPOs that are

  processed later have precedence over GPOs that are processed sooner. Group Policy objects are processed according to the following order:

  The local Group Policy object (LPGO) is applied.

  GPOs linked to sites.

  GPOs linked to domains

  GPOs linked to organizational units. In the case of nested organizational units, GPOs associated with parent organizational units are processed prior to GPOs associated with child organizational units.

  Changing the link order

  Within each domain, site, and organizational unit, the link order controls when links are applied. To change the precedence of a link, you can change the link order, moving each link up or down in the list to the appropriate location. The link

  with the higher order (with 1 being the highest order) has the higher precedence for a given site, domain, or organizational unit. For example, if you add six GPO links and later decide that you want the last one that you added to have highest

  precedence, you can move the GPO link to the top of the list.

  Blocking Group Policy inheritance

  You can block policy inheritance for a domain or organizational unit. Using block inheritance prevents GPOs linked to higher sites, domains, or organizational units from being automatically inherited by the child-level. By default, children

  inherit all GPOs from the parent, but it is sometimes useful to block inheritance. For example, if you want to apply a single set of policies to an entire domain except for one organizational unit, you can link the required GPOs at the domain

  level (from which all organizational units inherit policies by default), and then block inheritance only on the organizational unit to which the policies should not be applied.

  Enforcing a GPO link

  You can specify that the settings in a GPO link should take precedence over the settings of any child object by setting that link to Enforced. GPO-links that are enforced cannot be blocked from the parent container. Without enforcement from

  above, the settings of the GPO links at the higher level (parent) are overwritten by settings in GPOs linked to child organizational units, if the GPOs contain conflicting settings. With enforcement, the parent GPO link always has precedence.

  By default, GPO links are not enforced. In tools prior to GPMC, "enforced" was known as "No override."

  Disabling a GPO link

  By default, processing is enabled for all GPO links. You can completely block the application of a GPO for a given site, domain, or organizational unit by disabling the GPO link for that domain, site, or organizational unit.

  Note that this does not disable the GPO itself, and if the GPO is linked to other sites, domains or organizational units, they will continue to process the GPO, if their links are enabled.

  PO links set to enforce (no override) cannot be blocked.

  The enforce and block inheritance options should be used sparingly. Casual use of these advanced features complicates troubleshooting.

• Question 55:

  You need to recommend a solution for the file servers in the branch offices that meets the storage Requirements.

  What should you include in the recommendation?

  A. Distributed File System (DFS) and access-based enumeration (ABE)
  B. File Server Resource Manager (FSRM) quotas and file screens
  C. NTFS disk quotas and NTFS permissions
  D. Services for Network File System (NFS) and offline files
  B. File Server Resource Manager (FSRM) quotas and file screens

  ---

  http://technet.microsoft.com/en-us/library/cc732431.aspx

  File Server Resource Manager is a suite of tools for Windows Server?2008 that allows administrators to understand, control, and manage the quantity and type of data that is stored on

  their servers. By using File Server Resource Manager, administrators can place quotas on folders and volumes, actively screen files, and generate comprehensive storage reports. This set of advanced instruments not only helps the

  administrator efficiently monitor existing storage resources, but it also aids in the planning and implementation of future policy changes.

  Setting File Server Resource Manager Options Information about configuring general notification and reporting options before working with File Server Resource Manager.

  Quota Management Information about creating quotas that set a soft or hard space limit on a volume or folder tree.

  File Screening Management Information about creating file screening rules that block files from a volume or a folder tree.

  Storage Reports Management Information about generating storage reports that can be used to monitor disk usage patterns, identify duplicate files and dormant files, track quota usage, and audit file screening.

  Classification Management Information about creating and applying file classification properties, which are used to categorize files.

  File Management Tasks Information about performing file management tasks to automate the process of finding subsets of files on a server and applying simple commands.

  Managing Remote Storage Resources Information about performing resource management tasks on a remote computer where File Server Resource Manager is also installed.

  Troubleshooting File Server Resource Manager Instructions for problem solving.

  Using File Server Resource Manager

  Applies To: Windows Server 2008 R2

  There are several navigational options in the File Server Resource Manager snap-in. The following

  tables detail the navigational options in the File Server Resource Manager nodes, which include:

  Quotas

  Quota Templates

  File Screens

  File Screen Templates

  File Groups

  

• Question 56:

  You need to recommend changes to the DFS infrastructure that meet the company's security requirements. What should you recommend?

  A. Modify the NTFS permissions and the share permissions of the DFS targets.
  B. Modify the referrals settings of the DFS namespace and the NTFS permissions of the DFS targets.
  C. Migrate the namespace to Windows Server 2008 mode and modify the referrals settings.
  D. Migrate the namespace to Windows Server 2008 mode and enable accessbased enumeration (ABE).
  D. Migrate the namespace to Windows Server 2008 mode and enable accessbased enumeration (ABE).

  ---

  ABE is enabled by default and lets you hide files and folders from users who do not have access to them.

• Question 57:

  You need to recommend a solution to meet the following requirements:

  -Meet the company auditing requirements.

  - Ensure that further administrative action is not required when new folders are added to the file server.

  What should you recommend? (Choose all that Apply.)

  A. Enable the Audit File System Group Policy setting for Success.
  B. Enable the Audit object access Group Policy setting for Success.
  C. Enable the Audit File System Group Policy setting for Failure.
  D. Enable the Audit Handle Manipulation Group Policy setting for Success.
  E. Enable the File system option of the Global Object Access Auditing Group Policy setting.
  F. Enable the Audit Handle Manipulation Group Policy setting for Failure.
  B. Enable the Audit object access Group Policy setting for Success.
  D. Enable the Audit Handle Manipulation Group Policy setting for Success.
  E. Enable the File system option of the Global Object Access Auditing Group Policy setting.

  ---

  Security auditing allows you to track the effectiveness of your network defenses and identify attempts to circumvent them. There are a number of auditing enhancements in Windows Server 2008 R2 and Windows 7 that increase the level of

  detail in security auditing logs and simplify the deployment and management of auditing policies.

  Auditing policy

  Before you implement auditing policy, you must decide which event categories you want to audit.

  The auditing settings that you choose for the event categories define your auditing policy. On member servers and workstations that are joined to a domain, auditing settings for the event categories are undefined by default. On domain

  controllers, auditing is turned on by default. By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization.

  Audit Object Access

  This security setting determines whether to audit the event of a user accessing an object--for example, a file, folder, registry key, printer, and so forth--that has its own system access control list (SACL) specified.

  If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a user successfully accesses an object that has an appropriate SACL

  specified. Failure audits generate an audit entry when a user unsuccessfully attempts to access an object that has a SACL specified.

  To set this value to No auditing, in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

  Note that you can set a SACL on a file system object using the Security tab in that object's Properties dialog box.

  http://technet.microsoft.com/en-us/library/cc776774%28v=ws.10%29.aspx

  Audit Handle Manipulation Group Policy setting This policy setting determines whether the operating system generates audit events when a handle to an object is opened or closed. Only objects with configured SACLs generate these events,

  and only if the attempted handle operation matches the SACL. Event volume can be high, depending on how SACLs are configured.

  When used together with the Audit File System or Audit Registry policy settings, the Audit Handle Manipulation policy setting can provide an administrator with useful "reason for access," audit data detailing the precise permissions on which

  the audit event is based. For example, if a file is configured as a read-only resource but a user attempts to save changes to the file, the audit event will log not just the event itself but the permissions that were used, or attempted to be used, to

  save the file changes.

  Global Object Access Auditing Group Policy setting.

  Global Object Access Auditing. In Windows Server 2008 R2 and Windows 7, administrators can define computer-wide system access control lists (SACLs) for either the file system or registry.

  The specified SACL is then automatically applied to every single object of that type. This can be useful both for verifying that all critical files, folders, and registry settings on a computer are protected, and for identifying when an issue with a

  system resource occurs.

• Question 58:

  You need to recommend an IP addressing strategy for the client computers in the new sales office. What should you recommend implementing in the new sales office?

  A. DHCP server roles
  B. the DirectAccess feature
  C. the Network Policy Server (NPS) role service
  D. the Remote Access Service role service
  D. the Remote Access Service role service

  ---

  The Routing and Remote Access service in Windows Server?2008 supports remote user or site-to-site connectivity by using virtual private network (VPN) or dial-up connections. Routing and Remote Access consists of the following

  components:

  Remote Access

  The remote access feature provides VPN services so that users can access corporate networks over the Internet as if they were directly connected. Remote access also enables remote or mobile workers who use dial-up communication links

  to access corporate networks.

  Routing

  Routing and Remote Access is a full-featured software router and an open platform for routing and networking.

  It offers routing services to businesses in local area network (LAN) and wide area network (WAN) environments or over the Internet by using secure VPN connections. Routing is used for multiprotocol LAN-to-LAN, LAN-to-WAN, VPN, and

  network address translation (NAT) routing services.

  Routing

  A router is a device that manages the flow of data between network segments, or subnets. A router directs incoming and outgoing packets based on the information it holds about the state of its own network interfaces and a list of possible

  sources and destinations for network traffic. By projecting network traffic and routing needs based on the number and types of hardware devices and applications used in your environment, you can better decide whether to use a dedicated

  hardware router, a software-based router, or a combination of both. Generally, dedicated hardware routers handle heavier routing demands best, and less expensive software-based routers are sufficient to handle lighter routing loads.

  A software-based routing solution, such as the Routing and Remote Access service in Windows Server?2008, can be ideal on a small, segmented network with relatively light traffic between subnets. Conversely, enterprise network

  environments that have a large number of network segments and a wide range of performance requirements might need a variety of hardware-based routers to perform different roles throughout the network.

  Remote access

  By configuring Routing and Remote Access to act as a remote access server, you can connect remote or mobile workers to your organization's networks. Remote users can work as if their computers are physically connected to the network.

  All services typically available to a LAN-connected user (including file and print sharing, Web server access, and messaging) are enabled by means of the remote access connection. For example, on a server running Routing and Remote

  Access, clients can use Windows Explorer to make drive connections and to connect to printers. Because drive letters and universal naming convention (UNC) names are fully supported by remote access, most commercial and custom

  applications work without modification.

  A server running Routing and Remote Access provides two different types of remote access connectivity:

  Virtual private networking (VPN) VPN is the creation of secured, point-to-point connections across a private network or a public network such as the Internet. A VPN client uses special

  TCP/IP-based protocols called tunneling protocols to make a virtual call to a virtual port on a VPN server. The best example of virtual private networking is that of a VPN client that makes a VPN connection to a remote access server that is

  connected to the Internet. The remote access server answers the virtual call, authenticates the caller, and transfers data between the VPN client and the corporate network.

  In contrast to dial-up networking, VPN is always a logical, indirect connection between the VPN client and the VPN server over a public network, such as the Internet. To ensure privacy, you must encrypt data sent over the connection.

  Dial-up networking In dial-up networking, a remote access client makes a nonpermanent, dial-up connection to a physical port on a remote access server by using the service of a

  telecommunications provider, such as analog phone or ISDN. The best example of dial-up networking is that of a dial-up networking client that dials the phone number of one of the ports of a remote access server.

  Dial-up networking over an analog phone or ISDN is a direct physical connection between the dial-up networking client and the dial-up networking server. You can encrypt data sent over the connection, but it is not required.

• Question 59:

  You need to recommend a file access solution for the Templates share.

  Which two actions should you recommend? (Each correct answer presents part of the solution. Choose two.)

  A. Add File2 as a namespace server for \\fabrikam.com\dfs.
  B. Add \\File2\templates as a folder target for \\fabrikam.com\dfs\templates.
  C. In the Group Policy preferences of GPO2 and GPO3, add new mapped drives.
  D. Create a DFS Replication group that contains \\File1\templates and \\File2\templates.
  B. Add \\File2\templates as a folder target for \\fabrikam.com\dfs\templates.
  D. Create a DFS Replication group that contains \\File1\templates and \\File2\templates.

  ---

  http://technet.microsoft.com/en-us/library/cc753479%28WS.10%29.aspx

  Distributed File System (DFS) Namespaces and DFS Replication offer simplified, highly-available access to files, load sharing, and WAN-friendly replication. In the Windows Server?2003 R2 operating system, Microsoft revised and renamed

  DFS Namespaces (formerly called DFS), replaced the Distributed File System snap-in with the DFS Management snap-in, and introduced the new DFS Replication feature. In the Windows Server?2008 operating system, Microsoft added the

  Windows Server 2008 mode of domain-based namespaces and added a number of usability and performance improvements.

  What does Distributed File System (DFS) do?

  The Distributed File System (DFS) technologies offer wide area network (WAN)-friendly replication as well as simplified, highly-available access to geographically dispersed files. The two technologies in DFS are the following:

  DFS Namespaces. Enables you to group shared folders that are located on different servers into one or more logically structured namespaces. Each namespace appears to users as a single shared folder with a series of subfolders. This

  structure increases availability and automatically connects users to shared folders in the same Active Directory Domain Services site, when available, instead of routing them over WAN connections.

  DFS Replication. DFS Replication is an efficient, multiple-master replication engine that you can use to keep folders synchronized between servers across limited bandwidth network connections. It replaces the File Replication Service (FRS)

  as the replication engine for DFS Namespaces, as well as for replicating the AD DS SYSVOL folder in domains that use the Windows Server 2008 domain functional level.

• Question 60:

  Your company has a main office and a branch office. Your network contains a single Active Directory domain.

  You install 25 Windows Server 2008 R2 member servers in the branch office.

  You need to recommend a storage solution that meets the following requirements:

  -Encrypts all data on the hard disks

  - Allows the operating system to start only when the authorized user is present

  What should you recommend?

  A. Encrypting File System (EFS)
  B. File Server Resource Manager (FSRM)
  C. Windows BitLocker Drive Encryption (BitLocker)
  D. Windows System Resource Manager (WSRM)
  C. Windows BitLocker Drive Encryption (BitLocker)

  ---

  MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration:

  Planning BitLocker Deployment

  Windows BitLocker and Drive Encryption (BitLocker) is a feature that debuted in Windows Vista Enterprise and Ultimate Editions and is available in all versions of Windows Server 2008.

  BitLocker serves two purposes:

  protecting server data through full volume encryption and providing an integrity-checking mechanism to ensure that the boot environment has not been tampered with.

  Encrypting the entire operating system and data volumes means that not only are the operating system and data protected, but so are paging files, applications, and application configuration data. In the event that a server is stolen or a hard

  disk drive removed from a server by third parties for their own nefarious purposes, BitLockerensures that these third parties cannot recover any useful data. The drawback is that if the BitLocker keys for a server are lost and the boot

  environment is compromised, the data stored on that server will be unrecoverable.

  To support integrity checking, BitLocker requires a computer to have a chip capable of supporting the Trusted Platform Module (TPM) 1.2 or later standard. A computer must also have a BIOS that supports the TPM standard. When BitLocker

  is implemented in these conditions and in the event that the condition of a startup component has changed, BitLocker-protected volumes are locked and cannot be unlocked unless the person doing the unlocking has the correct digital keys.

  Protected startup components include the BIOS, Master Boot Record, Boot Sector, Boot Manager, and Windows Loader.

  From a systems administration perspective, it is important to disable BitLocker during maintenance periods when any of these components are being altered. For example, you must disable BitLocker during a BIOS upgrade. If you do not, the

  next time the computer starts, BitLocker will lock the volumes and you will need to initiate the recovery process. The recovery process involves entering a 48-character password that is generated and saved to a specified location when

  running the BitLocker setup wizard. This password should be stored securely because without it the recovery process cannot occur. You can also configure BitLocker to save recovery data directly to Active Directory; this is the recommended

  management method in enterprise environments.

  You can also implement BitLocker without a TPM chip. When implemented in this manner there is no startup integrity check. A key is stored on a removable USB memory device, which must be present and supported by the computer's BIOS

  each time the computer starts up. After the computer has successfully started, the removable USB memory device can be removed and should then be stored in a secure location. Configuring a computer running Windows Server 2008 to use

  a removable USB memory device as a BitLocker startup key is covered in the second practice at the end of this lesson.

  BitLocker Volume Configuration

  One of the most important things to remember is that a computer must be configured to support BitLocker prior to the installation of Windows Server 2008. The procedure for this is detailed at the start of Practice 2 at the end of this lesson, but

  involves creating a separate 1.5-GB partition, formatting it, and making it active as the System partition prior to creating a larger partition, formatting it, and then installing the Windows Server 2008 operating system. Figure 1-6 shows a volume

  configuration that supports BitLocker. If a computer's volumes are not correctly configured prior to the installation of Windows Server 2008, you will need to perform a completely new installation of Windows Server 2008 after repartitioning the

  volume correctly. For this reason you should partition the hard disk drives of all computers in the environment on which you are going to install Windows Server 2008 with the assumption that at some stage in the future you might need to

  deploy BitLocker.

  If BitLocker is not deployed, it has cost you only a few extra minutes of configuration time. If you later decide to deploy BitLocker, you will have saved many hours of work reconfiguring the server to support full hard drive encryption.

  

  Figure 1-6Partition scheme that supports BitLocker The necessity of having specifically configured volumes makes BitLocker difficult to implement on Windows Server 2008 computers that have been upgraded from Windows Server 2003. The necessary partition scheme would have had to be introduced prior to the installation of Windows Server 2003, which in most cases would have occurred before most people were aware of BitLocker.

  BitLocker Group Policies BitLocker group policies are located under the Computer Configuration\Policies\ Administrative Templates\Windows Components\BitLocker Drive Encryption node of a Windows Server 2008 Group Policy object. In the event that the computers you want to deploy BitLocker on do not have TPM chips, you can use the Control Panel Setup: Enable Advanced Startup Options policy, which is shown in Figure 1-7. When this policy is enabled and configured, you can implement BitLocker without a TPM being present. You can also configure this policy to require that a startup code be entered if a TPM chip is present, providing another layer of security.

  

  Figure 1-7Allowing BitLocker without the TPM chip

  Other BitLocker policies include:

  Turn On BitLocker Backup To Active Directory Domain ServicesWhen this policy is enabled, a computer's recovery key is stored in Active Directory and can be recovered by an authorized administrator.

  Control Panel Setup: Configure Recovery FolderWhen enabled, this policy sets the default folder to which computer recovery keys can be stored.

  Control Panel Setup: Configure Recovery OptionsWhen enabled, this policy can be used to disable the recovery password and the recovery key. If both the recovery password and the

  recovery key are disabled, the policy that backs up the recovery key to Active Directory must be enabled.

  Configure Encryption MethodThis policy allows the administrator to specify the properties of the AES encryption method used to protect the hard disk drive.

  Prevent Memory Overwrite On RestartThis policy speeds up restarts, but increases the risk of

  BitLocker being compromised.

  Configure TMP Platform Validation ProfileThis policy configures how the TMP security hardware protects the BitLocker encryption key.

  Encrypting File System vs. BitLocker Although both technologies implement encryption, there is a big difference between Encrypting File System (EFS) and BitLocker. EFS is used to encrypt individual files and folders and can be used to encrypt these items for different users. BitLockerencrypts the whole hard disk drive. A user with legitimate credentials can log on to a file server that is protected by BitLocker and will be able to read any files that she has permissions for. This user will not, however be able to read files that have been EFS encrypted for other users, even if she is granted permission, because you can only read EFS-encrypted files if you have the appropriate digital certificate. EFS allows organizations to protect sensitive shared files from the eyes of support staff who might be required to change file and folder permissions as a part of their job task, but should not actually be able to review the contents of the file itself. BitLocker provides a transparent form of encryption, visible only when the server is compromised. EFS provides an opaque form of encryption--the content of files that are visible to the person who encrypted them are not visible to anyone else, regardless of what file and folder permissions are set.

  Turning Off BitLocker In some instances you may need to remove BitLocker from a computer. For example, the environment in which the computer is located has been made much more secure and the overhead from the BitLocker process is causing performance problems. Alternatively, you may need to temporarily disable BitLocker so that you can perform maintenance on startup files or the computer's BIOS. As Figure 1-8 shows, you have two options for removing BitLocker from a computer on which it has been implemented: disable BitLocker or decrypt the drive.

  

  Figure 1-8Options for removing BitLocker

  Disabling BitLocker removes BitLocker protection without decrypting the encrypted volumes. This is useful if a TPM chip is present, but it is necessary to update a computer's BIOS or startup files.

  If you do not disable

  BitLocker when performing this type of maintenance, BitLocker--when implemented with a TPM chip--will lock the computer because the diagnostics will detect that the computer has been tampered with. When you disable BitLocker, a

  plaintext key is written to the hard disk drive. This allows the encrypted hard disk drive to be read, but the presence of the plaintext key means that the computer is insecure. Disabling BitLocker using this method provides no performance

  increase because the data remains encrypted--it is just encrypted in an insecure way. When BitLocker is re-enabled, this plaintext key is removed and the computer is again secure.

  Exam Tip Keep in mind the conditions under which you might need to disable BitLocker. Also remember the limitations of BitLocker without a TPM 1.2 chip.

  Select Decrypt The Drive when you want to completely remove BitLocker from a computer. This process is as time-consuming as performing the initial drive encryption--perhaps more so because more data might be stored on the computer

  than when the initial encryption occurred.

  After the decryption process is finished, the computer is returned to its pre-encrypted state and the data stored on it is no longer protected byBitLocker.

  Decrypting the drive will not decrypt EFS-encrypted files stored on the hard disk drive.