You manage Windows Server 2019 file servers in an AD DS domain. Security policy requires BitLocker for OS volumes with TPM-based protection and a startup PIN. Compliance also requires that recovery information be automatically backed up to AD DS before BitLocker is enabled. Servers have TPM 2.0. What should you configure to meet both requirements? Choose two actions.

The first correct option, "In a GPO, enable 'Require additional authentication at startup' and allow 'TPM + PIN'," directly addresses the requirement for TPM-based protection with a startup PIN. This Group Policy setting configures BitLocker to prompt for a PIN in addition to using the TPM during startup, enhancing security. The second correct option, "In a GPO, under 'Choose how BitLocker-protected operating system drives can be recovered', enable 'Save BitLocker recovery information to AD DS for operating system drives' and 'Do not enable BitLocker until recovery information is stored'," fulfills the compliance requirement to automatically back up recovery information to AD DS before BitLocker is enabled. This ensures recovery keys are available in Active Directory for auditing and recovery purposes. Enabling BitLocker Network Unlock would bypass the PIN, violating the security policy. Using TPM-only protection without a PIN also violates the PIN requirement. Storing recovery keys in Azure AD is not specified and does not meet the requirement to store them in AD DS.