mediumMultiple ChoiceObjective-mapped
Full Disk Encryption: BitLocker for Stolen Laptops
A company requires that all sensitive data be encrypted when stored on laptops. Which technology should be implemented to ensure data is protected even if a laptop is stolen?
Quick Answer
The answer is BitLocker Drive Encryption, the correct technology to protect sensitive data on a stolen laptop. This is because BitLocker implements full disk encryption (FDE), which encrypts the entire drive, including the operating system, applications, and all files, making the data completely unreadable without the proper decryption key or authentication. In the context of the CompTIA A+ Core 2 220-1202 exam, this question tests your understanding of data protection and physical security controls, often appearing in scenarios involving lost or stolen devices. A common trap is confusing file-level encryption (like EFS) with full disk encryption; remember that BitLocker protects the entire volume at boot time, while EFS only protects individual files after the OS is running. A helpful memory tip: think of BitLocker as locking the entire room, not just the filing cabinet inside it.
⚠ Common exam trap
Candidates often confuse file-level encryption (EFS) with full-disk encryption, mistakenly believing that encrypting individual files provides sufficient protection for an entire stolen laptop, when in fact EFS leaves system files, temporary files, and the pagefile unencrypted and vulnerable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BitLocker Drive Encryption
BitLocker Drive Encryption provides full-volume encryption that protects all data on the system drive, including the operating system, applications, and user files. Even if a laptop is stolen and the hard drive is removed, the data remains inaccessible without the correct recovery key or authentication credentials, ensuring compliance with data protection requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
File-level encryption using EFS
Why it's wrong here
EFS encrypts individual files but can leave system files and metadata exposed, offering less comprehensive protection than FDE.
- ✓
BitLocker Drive Encryption
Why this is correct
BitLocker provides full disk encryption, protecting all data on the drive, which is ideal for stolen laptops.
- ✗
TPM chip only
Why it's wrong here
A TPM chip stores encryption keys but does not encrypt data by itself; it must be used with FDE software.
- ✗
Secure Boot
Why it's wrong here
Secure Boot ensures only trusted OS components load but does not encrypt stored data.
Go deeper
Related to this question
About these practice questions
One of 495 original 220-1202 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on 220-1202
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company policy requires that all sensitive data stored on laptops must be unreadable if the device is lost or stolen. A technician is tasked with implementing a solution that works transparently for users. Which approach should they take?
easy- ✓ A.Enable BitLocker drive encryption on each laptop.
- B.Set a BIOS password on each laptop.
- C.Implement a folder-level password policy using EFS.
- D.Configure a screensaver password with a 1-minute timeout.
Why A: BitLocker drive encryption provides full-disk encryption that operates transparently to the user, automatically encrypting all data on the system drive. If the laptop is lost or stolen, the data remains unreadable without the decryption key, satisfying the policy requirement without requiring user intervention.
Variation 2. An organization wants to ensure that even if a laptop is stolen, the data on the hard drive cannot be read. The laptop runs Windows 10 Pro and is used by employees who travel frequently. Which security feature should be enabled?
hard- ✓ A.Enable BitLocker Drive Encryption on the system drive.
- B.Set a strong BIOS/UEFI password.
- C.Configure a screensaver password with a short timeout.
- D.Use EFS to encrypt individual files and folders.
Why A: BitLocker Drive Encryption is the correct choice because it encrypts the entire system drive at the block level, using AES encryption (typically 128-bit or 256-bit) with a TPM (Trusted Platform Module) to protect the encryption keys. This ensures that if the laptop is stolen, the hard drive cannot be removed and read from another system, as the data remains encrypted without the correct authentication (e.g., TPM + PIN or recovery key).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.