Detective laptops must bind full-disk encryption keys to evidence of platform integrity before unlocking. Which capability best supports that design?
Select an answer to reveal the explanation.
Short Explanation
Think of the TPM as a tiny sealed vault on the motherboard that only opens the disk key if the laptop still looks like itself. Sticky notes and shared spreadsheets are the opposite of that idea.
Full Explanation
Detective laptops that must bind full-disk encryption keys to evidence of platform integrity need a hardware root of trust that can measure boot state and release keys only when the platform matches expected measurements. A Trusted Platform Module (TPM) seals encryption keys to measured platform state (PCR values reflecting firmware/boot components), so disk unlock fails if Secure Boot/boot chain integrity is broken—supporting designs where FDE keys are not usable on tampered devices. Storing the disk passphrase in an unencrypted sticky-note macro on the desktop defeats FDE entirely. Disabling Secure Boot so any USB toolkit can rewrite the bootloader quietly undermines the measurements the seal depends on. Keeping encryption keys only in a cloud spreadsheet shared to the whole bureau creates mass key exposure and no binding to device state. Exam caveat: associate TPM sealing / measured boot with protecting keys relative to platform integrity; do not confuse TPM with antivirus or with storing secrets in shared documents. Operational check: enable TPM and Secure Boot on detective endpoints, configure BitLocker/FileVault (or equivalent) with TPM sealing, test that boot-kit changes block unlock, prohibit passphrase macros and shared key sheets, and monitor for TPM clear or Secure Boot disable events.