easyMultiple ChoiceObjective-mapped
220-1102 Practice Question: A technician is configuring a new Windows 10…
A technician is configuring a new Windows 10 workstation for a remote employee who will handle sensitive customer data. Which security feature should be enabled to ensure that if the laptop is lost, the data remains protected?
⚠ Common exam trap
CompTIA often tests the distinction between authentication/access control features (like UAC or Windows Hello) and data-at-rest encryption (BitLocker), leading candidates to choose a security feature that protects the system while running rather than protecting data when the device is physically compromised.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BitLocker Drive Encryption
BitLocker Drive Encryption (C) is the correct choice because it provides full-disk encryption using AES encryption algorithms, ensuring that if the laptop is lost or stolen, the sensitive customer data remains inaccessible without the recovery key or TPM authentication. This directly addresses the requirement to protect data at rest on a lost device.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Windows Defender Firewall
Why it's wrong here
Windows Defender Firewall operates at the network layer, inspecting incoming and outgoing network traffic to block unauthorized access attempts and malicious connections. While crucial for preventing remote attacks and securing the system from network-based threats, it does not provide any encryption for data stored on the local drive. Therefore, if the physical drive is removed from the workstation, the data remains unencrypted and fully accessible to anyone with physical possession.
- ✗
User Account Control (UAC)
Why it's wrong here
User Account Control (UAC) is a security feature designed to prevent unauthorized changes to the operating system by requiring administrative consent for actions that could affect system security or stability. It prompts users for permission before allowing applications to make changes that require elevated privileges, even if the user is an administrator. However, UAC's protection is entirely dependent on the operating system being active and does not encrypt the data on the drive itself, rendering it ineffective if the drive is physically removed and accessed externally.
- ✓
BitLocker Drive Encryption
Why this is correct
BitLocker Drive Encryption is a full-disk encryption feature integrated into Windows that encrypts the entire volume where the operating system and user data reside. It uses a cryptographic key, often stored in a Trusted Platform Module (TPM) chip or provided by the user, to protect all data at rest. This encryption renders the data unreadable and inaccessible without the correct decryption key, making it the ideal solution for protecting sensitive information if the workstation's drive is lost, stolen, or removed from the system.
- ✗
Windows Hello for Business
Why it's wrong here
Windows Hello for Business provides a robust, multi-factor authentication mechanism, enabling users to sign in to Windows devices, apps, and online services using biometrics like facial recognition or fingerprints, or a PIN. While it significantly enhances login security and prevents unauthorized access to the *active* user session, it is purely an authentication method. It does not encrypt the underlying data on the storage drive, meaning that if the physical drive is extracted from the workstation, the data remains unencrypted and vulnerable to direct access.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Windows Editions and Features
Key term
BitLocker
BitLocker is a full-disk encryption feature built into Windows that protects data by encrypting the entire drive so that unauthorized users cannot access files without the correct recovery key.
Key term
Windows 10
Windows 10 is a personal computer operating system developed by Microsoft that combines the familiarity of Windows 7 with the modern features of Windows 8, designed to run on a wide range of devices from desktops to tablets.
About these practice questions
This 220-1202 question is part of Courseiva's 495-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.