220-1102 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  BitLocker

  Why this is correct

  BitLocker Drive Encryption provides full-volume encryption by encrypting the entire Windows system and data drives with AES (Advanced Encryption Standard) using 128-bit or 256-bit keys, making data unreadable without the proper authentication. It can optionally integrate with a TPM to tie the encryption keys to the hardware, and it requires a recovery key or password for decryption when booting a compromised or different environment. BitLocker is available in Windows 10 Pro and Enterprise editions (not Home), and is the correct tool for ensuring that all sensitive data at rest is protected in case the laptop is lost or stolen.

• ✗

  EFS

  Why it's wrong here

  EFS (Encrypting File System) is a user-level encryption feature that protects only individual files and folders selected by the user, typically via the file's Properties > Advanced settings. It relies on the user's profile certificate and does not encrypt the entire volume, leaving the operating system files, page files, temp files, and unselected data vulnerable. Because the scenario calls for protecting all sensitive data on the entire laptop drive against loss or theft, EFS is not a sufficient full-disk encryption solution.

• ✗

  TPM

  Why it's wrong here

  TPM (Trusted Platform Module) is a hardware security chip that securely stores cryptographic keys, hashes, and certificates to attest to the platform's integrity. It is a foundation or enabler for BitLocker—allowing key sealing to hardware—but it does not perform any data encryption on its own. Without an encryption engine like BitLocker, the data on the drive remains in plaintext and is fully accessible if the drive is removed, so TPM alone cannot satisfy the requirement for protecting sensitive data.

• ✗

  Secure Boot

  Why it's wrong here

  Secure Boot is a UEFI firmware feature that verifies the digital signature of the bootloader and other pre-boot components to ensure they are trusted and have not been tampered with, preventing unauthorized operating systems or rootkits from loading. It is a platform integrity mechanism that secures the boot process but does not encrypt any data on the disk. After the operating system boots, Secure Boot plays no role in protecting files, and even before boot it only checks signatures—it does not prevent someone from removing the hard drive and reading its contents directly, so it is not a data-at-rest encryption solution.

Go deeper

Related to this question