Exam MD-100 topic 3 question 85 discussion

"manage-bde.exe -protectors -aadbackup" is the command to throw the keus it to Azure AD

Regarding the docs you should first run the command for adding keyprotector. Not after the device is encrypted. So in that case it should be A.https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises#powershell-examples

Aは間違っている。 無効にしたあと、有効にする必要がある。 無効にしただけでは達成できない。

The correct answer is B. Add a BitLocker key protector. To ensure that you can recover the BitLocker recovery key for the computers from Azure AD after joining them to Azure AD, you should add a BitLocker key protector. A BitLocker key protector is a way to store a copy of the BitLocker recovery key in a safe location, such as Azure AD, which can be used to recover the drive in case of a hardware failure or other issue.

again wrong answer. diable and enable bitlocker

You create the key protector, then you upload it to Azure AD.

Not completely official: https://campbell.scot/store-bitlocker-recovery-keys-in-azure-ad-for-devices-already-encrypted/. Seems to suggest you can do this without disabling bitlocker. B is the best answer.

Well - I can only see B as an option, the other three answers are completely nonsense?

Essa questão ficou muito dividida no gabarito, afinal qual seria a resposta e qual a justificativa? Após um debate de 9 comentários, o gabarito é o mesmo ou não?

B. seems like the best option https://www.windowscentral.com/how-use-bitlocker-encryption-windows-10

Control Panel\All Control Panel Items\BitLocker Drive Encryption Backup your recovery keys

In general, the number one is correct. You can test it on your own.

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-protectors

To save the encryption key to Azure AD, the only thing you need to do is log in using an Azure account. The recovery key would be backed up to Azure.

I can't find anything to back this up but I think this is wrong. I think the only way you can escrow those keys is to disable BitLocker and then re-enable. So the first step would be to disable BitLocker.