220-1102 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Encrypting File System (EFS)

  Why it's wrong here

  EFS (Encrypting File System) is a Windows NTFS feature that encrypts individual files or folders on a per-user basis, using a file encryption key (FEK) derived from the user's password. It does not encrypt the entire system volume, leaving critical metadata, Pagefile.sys, hiberfil.sys, and the OS kernel unencrypted and accessible. Because it relies on the user's Windows credentials rather than a TPM, it provides no protection against an attacker who boots from a separate OS or extracts the drive. Therefore, EFS is unsuitable for full-device data protection in a laptop theft scenario.

• ✓

  BitLocker Drive Encryption

  Why this is correct

  BitLocker Drive Encryption is a full-volume encryption feature built into Windows 10 Pro and Enterprise that encrypts the entire Windows system volume, including user files, system files, the pagefile, and hibernation files. It uses the TPM to securely store the full-volume encryption key and can be configured with a PIN or USB startup key for pre-boot authentication, ensuring that an attacker cannot decrypt the drive by simply removing the hard disk. This makes BitLocker the correct and standard solution for protecting a laptop's data at rest if the device is physically stolen.

• ✗

  Windows Defender Firewall

  Why it's wrong here

  Windows Defender Firewall is a host-based network firewall that filters inbound and outbound traffic based on IP addresses, ports, and application rules. It operates at the network layer and is designed to block unauthorized network connections, not to encrypt or secure data stored on the local hard drive. If a laptop is physically stolen, the firewall becomes irrelevant because the attacker can bypass it entirely by removing the storage drive or booting from an external medium. Thus, it does nothing to prevent the thief from reading the data at rest.

• ✗

  Secure Boot

  Why it's wrong here

  Secure Boot is a UEFI firmware security feature that verifies the digital signature of boot loaders and kernel drivers against certificates stored in the UEFI database, preventing unsigned or malicious code from executing during the boot process. While it protects against bootkits and rootkits, it does not encrypt any data on the hard drive. The contents of the drive remain in plaintext, so an attacker who physically removes the drive and connects it to another computer can still read all unprotected files. Therefore, Secure Boot is a boot integrity control, not a data-at-rest encryption mechanism.

Go deeper

Related to this question