SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Hashing the files

  Why it's wrong here

  Hashing generates a fixed-length digest that serves as a fingerprint to detect unauthorized modification, but it is a one-way integrity check, not a confidentiality control. A thief who steals the laptop can still read the plaintext files directly from the storage medium; the hash value provides no key or algorithm to encrypt or obscure the file contents. Even if the hash is stored separately, it merely proves that a file existed in a certain form after the fact, offering zero protection against data disclosure.

• ✓

  Full-disk encryption

  Why this is correct

  Full-disk encryption (FDE) encrypts the entire storage volume, including the operating system, applications, and user files, using a symmetric cipher such as AES. When the laptop is powered off or the volume is locked, the encryption key is not readily available, so the storage media appears as random data to anyone who removes the drive or boots from external media. A thief cannot recover the sales manager's files without the correct passphrase, PIN, or hardware-bound key, making FDE the definitive control for protecting data at rest on portable devices.

• ✗

  Using TLS on the office Wi-Fi

  Why it's wrong here

  TLS (Transport Layer Security) encrypts network traffic between the laptop and a Wi-Fi access point or a server, protecting data in transit from eavesdropping on the wire. However, the files stored locally on the laptop's disk are not processed through TLS at rest; TLS operates at the session or application layer only during communication. Once the laptop is stolen and the disk is accessed directly, all previously stored files are still in plaintext because no transport encryption was ever applied to the static storage.

• ✗

  File compression

  Why it's wrong here

  File compression reduces the physical size of data by removing redundancy, typically using algorithms like DEFLATE or LZMA, but it is a lossless storage optimization, not a security measure. A compressed file is simply an encoded representation that can be decompressed by standard tools without requiring any secret credential, so any thief can reverse the process and recover the original data. Moreover, compression can actually aid a malicious actor by making exfiltration easier, as the smaller payload is faster to copy while still completely readable after decompression.

Go deeper

Related to this question