TestOut Labs Practice Test

BitLocker on the OS drive uses the TPM to securely store the encryption keys and to verify boot integrity. The TPM provides hardware-backed protection so the encryption key remains with the hardware, making it much harder for an attacker to access the data if the drive is moved to another system or tampered with during boot. Because of this, the BIOS/UEFI must have the TPM enabled and activated (and initialized) so Windows can take ownership of the TPM and use it to protect the BitLocker key. That’s why turning on and activating TPM security is the required step. Enabling Secure Boot helps with boot integrity and overall security, but BitLocker can work without it, so it’s not strictly required to enable BitLocker. Disabling the TPM would prevent TPM-backed protection, potentially forcing BitLocker into a less secure software-only mode. Setting the BIOS to Legacy Boot bypasses UEFI features that BitLocker often relies on, and is not necessary for enabling BitLocker on the OS drive.