Exercise 2: FileVault vs. BitLocker — Possible Solution
====================================================================

THE PARALLEL AND THE TWO HARDWARE COMPONENTS
------------------------------
Per this chapter, FileVault and BitLocker (Windows 11 Fundamentals 9) do the same underlying job - full-disk encryption - and both tie their encryption keys to dedicated, isolated hardware rather than ordinary storage. On the Mac side, that hardware is the Secure Enclave (the same component Chapter 3 introduced for Touch ID); on the Windows 11 side, it's the TPM (Trusted Platform Module) chip. This is the identical "keep key material in dedicated hardware" pattern Chapter 3 already established for biometric authentication, now applied to full-disk encryption specifically.

THE APPLE SILICON NUANCE
------------------------------
The chapter notes that on Apple Silicon Macs, the internal SSD is always encrypted at the hardware level via the Secure Enclave, regardless of whether the user has actually turned FileVault on in System Settings. Turning FileVault "on" doesn't start encryption from nothing - it adds a separate, user-facing layer on top of that always-on baseline encryption, requiring an actual password or recovery key to unlock the disk at boot.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly names the Secure Enclave and TPM as the two hardware components involved and explains they serve the same key-protection role for each OS, and correctly describes the Apple Silicon nuance that hardware-level encryption exists independently of the user-facing FileVault toggle.