mediumMultiple ChoiceObjective-mapped
220-1102 Practice Question: A company's security policy mandates that all USB…
A company's security policy mandates that all USB flash drives must be encrypted before use. A user inserts a new USB drive and wants to encrypt it on a Windows 10 Pro workstation. Which built-in tool should be used?
⚠ Common exam trap
CompTIA often tests the distinction between EFS (file-level encryption) and BitLocker (full-volume encryption), and the trap here is that candidates mistakenly choose EFS because they associate 'encryption' with file-level protection, not realizing that EFS cannot encrypt an entire removable drive and is not designed for USB flash drives.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable BitLocker To Go on the USB drive.
BitLocker To Go is the built-in Windows 10 Pro feature specifically designed to encrypt removable drives such as USB flash drives. It uses AES encryption to protect the entire volume, and the drive can be accessed only with a password, smart card, or recovery key. This directly satisfies the company's mandate for encrypting USB drives before use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use EFS (Encrypting File System) on the USB drive.
Why it's wrong here
Using EFS (Encrypting File System) on a USB drive is generally not recommended for company security policies requiring portable data protection. EFS is a file-level encryption feature integrated with the NTFS file system, meaning it cannot be applied to other file systems commonly used on USB drives like exFAT or FAT32. Furthermore, EFS encryption keys are tied to specific user accounts and systems, making data inaccessible if the drive is moved to another computer or user profile without proper certificate export and import.
- ✓
Enable BitLocker To Go on the USB drive.
Why this is correct
Enabling BitLocker To Go on the USB drive is the most appropriate solution for encrypting removable media to meet a company's security policy. BitLocker To Go provides full-disk encryption specifically designed for portable storage devices, ensuring all data on the drive is encrypted at rest. It is a robust, built-in feature of Windows Pro and Enterprise editions, offering strong protection and requiring a password or smart card for access, even if the drive is lost or stolen.
- ✗
Format the drive as exFAT and set a password.
Why it's wrong here
Formatting a drive as exFAT and setting a password does not provide true data encryption. While a password might be set through a third-party utility or a basic operating system prompt, this typically only restricts access to the drive's contents, not encrypting the data itself. The underlying data remains unencrypted and can be easily accessed by bypassing the password prompt or connecting the drive to another system that does not enforce the password, leaving sensitive information vulnerable.
- ✗
Use the cipher command to encrypt the drive.
Why it's wrong here
The `cipher` command is primarily a command-line utility used to manage EFS (Encrypting File System) on NTFS volumes, not to encrypt entire removable drives. While it can encrypt individual files or folders and securely overwrite free space to prevent data recovery, it does not offer full-volume encryption like BitLocker To Go. Its functionality is limited to file-level operations within the NTFS file system, making it unsuitable for comprehensive removable media encryption.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Windows Editions and Features
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Recovery
Recovery is the process of restoring systems, data, and operations after a security incident, failure, or disaster to return to normal functioning.
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.