220-1102 Security Practice Question
A company's security policy requires that all laptops used by field employees have the entire operating system drive encrypted to protect data in case of theft. Which Windows feature should be enabled to meet this requirement?
⚠ Common exam trap
Many candidates confuse Windows Defender Firewall with a security feature that 'protects' data, but it only protects against network-based threats, not physical theft or offline data access, which is the core requirement for drive encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BitLocker Drive Encryption
BitLocker Drive Encryption is the correct Windows feature because it provides full-disk encryption (FDE) for the entire operating system drive, meeting the requirement to protect data on laptops in case of theft. BitLocker uses AES encryption algorithms (typically 128-bit or 256-bit) and requires a Trusted Platform Module (TPM) chip for secure key storage, ensuring that data is inaccessible without the correct authentication (e.g., PIN, USB key, or recovery key). This directly addresses the security policy's mandate for whole-drive encryption on field employee laptops.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
BitLocker Drive Encryption
Why this is correct
BitLocker Drive Encryption is the correct answer because it provides full-volume encryption using AES (XTS-AES 128/256), which encrypts the entire operating system and data partitions at rest. It typically leverages a Trusted Platform Module (TPM) to validate boot integrity and safely hold the encryption keys, ensuring that if a laptop is lost or stolen, the unauthorized user cannot read files without the recovery key or PIN, thus satisfying the security policy's data-at-rest protection requirement.
- ✗
Windows Defender Firewall
Why it's wrong here
Windows Defender Firewall is incorrect because it operates as a network filtering component, examining inbound and outbound traffic based on stateful rules for ports, protocols, and program boundaries. It does not perform any cryptographic operations on the file system, so data stored on the disk remains unencrypted. Even with a perfectly configured firewall, an attacker with physical possession of the laptop can bypass the network stack and directly read data from the drive using a bootable USB or by removing the disk.
- ✗
User Account Control (UAC)
Why it's wrong here
User Account Control (UAC) is incorrect because it is a privilege elevation mechanism, not an encryption tool. UAC prompts for consent or credentials when a process requests administrative rights, leveraging security tokens and mandator integrity levels to prevent unauthorized system changes in a logged-on session. It protects system state and configuration by limiting write access to privileged areas, but it has zero effect on the confidentiality of data at rest, as it does not transform or scramble file contents on the storage medium.
- ✗
Windows Update
Why it's wrong here
Windows Update is incorrect because it is a software maintenance service that delivers security patches, bug fixes, and feature updates for Windows and associated Microsoft components. While patching addresses known vulnerabilities in software, this process does not apply any type of whole-disk encryption; it leaves the filesystem data readable in plaintext. Thus, even a fully updated system remains vulnerable to data disclosure from physical theft, which is the exact scenario the security policy aims to mitigate.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Encryption Concepts for A+
Key term
Recovery
Recovery is the process of restoring systems, data, and operations after a security incident, failure, or disaster to return to normal functioning.
Key term
Trusted Platform Module
A Trusted Platform Module (TPM) is a dedicated microcontroller chip that securely stores cryptographic keys, passwords, and certificates to protect a computer's hardware and ensure system integrity.
About these practice questions
This 220-1102 question is part of Courseiva's 925-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.