hardMultiple Choice
220-1202 Practice Question: Wants to ensure that even if a laptop is stolen,…
An organization wants to ensure that even if a laptop is stolen, the data on the hard drive cannot be read. The laptop runs Windows 10 Pro and is used by employees who travel frequently. Which security feature should be enabled?
⚠ Common exam trap
CompTIA A+ often tests the distinction between encryption at rest (BitLocker) and access control (BIOS password, screensaver) or partial encryption (EFS), leading candidates to choose a non-encryption option that does not protect data when the drive is physically removed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable BitLocker Drive Encryption on the system drive.
BitLocker Drive Encryption is the correct choice because it encrypts the entire system drive at the block level, using AES encryption (typically 128-bit or 256-bit) with a TPM (Trusted Platform Module) to protect the encryption keys. This ensures that if the laptop is stolen, the hard drive cannot be removed and read from another system, as the data remains encrypted without the correct authentication (e.g., TPM + PIN or recovery key).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable BitLocker Drive Encryption on the system drive.
Why this is correct
BitLocker encrypts the entire system drive with AES, so data remains unreadable if the laptop is stolen. Because travelling employees face physical theft risk, full-disk encryption addresses the confidentiality requirement directly, unlike passwords or BIOS locks.
- ✗
Set a strong BIOS/UEFI password.
Why it's wrong here
A BIOS/UEFI password blocks firmware and boot modification but leaves the drive readable once removed and attached elsewhere, so stolen data remains accessible. It is tempting because it deters casual tampering, and would suit restricting boot-device or firmware changes rather than protecting data at rest.
- ✗
Configure a screensaver password with a short timeout.
Why it's wrong here
A screensaver password only locks the running session after inactivity; the drive itself stays unencrypted, so an attacker who removes it reads everything. It is tempting because it is a familiar endpoint control, and would suit deterring walk-up access to an unattended machine, not theft.
- ✗
Use EFS to encrypt individual files and folders.
Why it's wrong here
EFS encrypts only selected files and folders, leaving unencrypted data, system files and other user profiles readable after the drive is removed. It is tempting because it protects specific sensitive documents, and would be correct for granular per-file protection rather than whole-disk encryption.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 687 original 220-1202 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.