mediumMultiple ChoiceObjective-mapped
220-1102 Practice Question: A small business owner wants to ensure that all…
A small business owner wants to ensure that all company laptops are protected in case of theft. They need a solution that encrypts the entire hard drive and requires a pre-boot PIN. Which security feature should you implement?
⚠ Common exam trap
Watch out — candidates often confuse EFS with full-disk encryption or assume a BIOS password alone secures data, but only BitLocker with TPM + startup PIN provides the required pre-boot authentication and full-drive encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable BitLocker with a TPM + startup PIN.
BitLocker with a TPM + startup PIN provides full-disk encryption and requires a pre-boot authentication PIN, meeting the requirement to protect the entire hard drive in case of theft. The TPM validates system integrity, and the PIN must be entered before the OS loads, preventing unauthorized access even if the drive is removed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable EFS (Encrypting File System) on the Documents folder.
Why it's wrong here
EFS (Encrypting File System) is a feature of Windows that allows for the encryption of individual files and folders, not an entire drive. While it protects data at rest, it does not provide full disk encryption, meaning other unencrypted files on the drive remain vulnerable. Crucially, EFS does not implement a pre-boot authentication mechanism like a PIN for the entire operating system, failing to meet the requirement for securing the *entire* drive before Windows loads.
- ✗
Set a BIOS password.
Why it's wrong here
Setting a BIOS password primarily prevents unauthorized users from booting the operating system or altering system firmware settings. While it can deter casual access, it offers no data encryption whatsoever. If the hard drive is physically removed from the computer and connected to another system, all data on the drive would be fully accessible without any password or encryption key, thus failing to protect the data itself.
- ✓
Enable BitLocker with a TPM + startup PIN.
Why this is correct
Enabling BitLocker with a Trusted Platform Module (TPM) and a startup PIN provides robust full disk encryption. The TPM securely stores the encryption keys and verifies the system's boot integrity, while the startup PIN adds a crucial second factor of authentication. This configuration ensures that the entire drive's contents remain encrypted and inaccessible until the correct PIN is entered *before* the operating system even begins to load, effectively protecting all data even if the drive is physically removed.
- ✗
Install a third-party antivirus with encryption.
Why it's wrong here
Installing a third-party antivirus solution primarily focuses on detecting, preventing, and removing malware and other security threats. While some advanced security suites might include features like file encryption or secure vaults, they typically do not provide comprehensive full disk encryption that operates at the pre-boot level across the entire drive. Such solutions are generally not designed to secure the entire storage device before the operating system loads, unlike native full disk encryption technologies.
Go deeper
Related to this question
Learn chapter
Windows Security Features
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 495 original 220-1202 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.