To enforce the FDE policy, the following requirement must be met?

Full Disk Encryption begins only after the endpoint retrieves the dedicated FDE machine-based policy from the Endpoint Management Server; this policy contains the encryption and pre-boot authentication directives required to enforce disk protection.

B. FDE certificates are used for recovery, not for initial enforcement of policy.

C. Post-boot users are a usability feature; enforcement does not depend on their existence.

D. Recovery files are created by the management server automatically and need not be encrypted beforehand.

1. Check Point Endpoint Security R81.10 Administration Guide, “Full Disk Encryption – Policy Workflow”, p.165: “Encryption starts after the client receives an FDE machine policy.”

2. Check Point sk108699, “Deploying Full Disk Encryption”, Section ‘Policy Prerequisites’.