220-1102 Security Practice Question
An organization requires that all laptops have full-disk encryption to protect data in case of theft. Which Windows 10 feature should be used to meet this requirement?
⚠ Common exam trap
A common mix-up: candidates confuse EFS (file-level encryption) with BitLocker (full-disk encryption), assuming any encryption feature meets the requirement, but EFS does not protect system files or data when the OS is not running, making it insufficient for theft scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BitLocker Drive Encryption
BitLocker Drive Encryption is the correct Windows 10 feature for full-disk encryption because it encrypts the entire volume, including system files, hibernation files, and page files, using AES encryption algorithms (128-bit or 256-bit). This ensures that if a laptop is stolen, the data remains inaccessible without the recovery key or TPM authentication, meeting the organization's requirement for data protection at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypting File System (EFS)
Why it's wrong here
EFS encrypts only individual files or folders using a per-user certificate, leaving the operating system, pagefile, and all other data in plaintext. It relies on the user's profile and recovery agents, so it cannot protect the entire volume or data at rest when the laptop is lost. Since the requirement is full disk encryption, EFS is insufficient because it does not secure system files or the boot process.
- ✓
BitLocker Drive Encryption
Why this is correct
BitLocker Drive Encryption uses AES to encrypt the entire Windows volume, including system files, user data, and the pagefile, creating a single protected container. When the system boots, the TPM or a startup PIN unlocks the volume keys before Windows loads, preventing unauthorized access from a stolen or lost laptop even if the drive is removed. This natively satisfies the full disk encryption requirement for Windows Pro/Enterprise laptops.
- ✗
NTFS permissions
Why it's wrong here
NTFS permissions assign access rights via access control lists (ACLs) to users and groups, controlling who can read, write, or execute files. However, they do not alter the underlying data on the disk; the bits remain readable by any tool that can bypass the filesystem, such as booting from a Linux USB or attaching the drive to another machine. Permissions are an authorization control, not a confidentiality control, so they do not encrypt anything and fail the full-disk encryption requirement.
- ✗
Windows Defender
Why it's wrong here
Windows Defender is a security solution that detects and removes malware, viruses, and other malicious software in real time. It does not perform any cryptographic transformation on stored data, so the disk contents remain unencrypted and readable offline. While Defender protects against active threats during runtime, it provides zero protection for data at rest on a lost or stolen device, so it is not a form of full disk encryption.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Data Sanitization: Wipe, Degauss, Shred, Incinerate
Key term
Recovery
Recovery is the process of restoring systems, data, and operations after a security incident, failure, or disaster to return to normal functioning.
Key term
Data protection
Data protection refers to the practices and technologies used to safeguard personal and sensitive information from unauthorized access, loss, or corruption.
About these practice questions
This 220-1102 question is part of Courseiva's 925-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.