SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Require a screen lock after five minutes of inactivity.

  Why it's wrong here

  While a screen lock after five minutes deters shoulder surfers and casual office access, it does nothing once the laptop is physically stolen and the SSD/HDD is removed, because the screen lock only gates the OS login, not the raw disk. An attacker can boot from a live USB or connect the drive to another machine and read files directly, bypassing the lock entirely. For traveling sales staff, the drive may be gone before the timeout even triggers, so this is an inadequate safeguard against data theft.

• ✓

  Enable full-disk encryption with a hardware-backed key store such as a TPM, preferably with a pre-boot PIN.

  Why this is correct

  Full-disk encryption with a TPM-backed key store ensures the disk's encryption key is sealed to the device's firmware state, and adding a pre-boot PIN requires something you know in addition to the hardware. Without the PIN, the TPM won't release the key, so the drive cannot be decrypted even if it's removed and mounted elsewhere. This protects all data at rest, including OS files, and is the strongest practical defense when a device might fall into a thief's hands on the road.

• ✗

  Encrypt only the most sensitive folders with file-level encryption.

  Why it's wrong here

  File-level encryption, such as EFS, only protects specific files or folders, leaving the rest of the disk — paging files, temp files, unencrypted copies of sensitive documents — exposed. Attackers with physical access can read metadata, application caches, and system files, and they may obtain decryption keys from the OS if the user is logged in or if the keys are stored on the same drive. With a full-drive theft, this piecemeal approach creates gaps that a determined forensic examiner can exploit.

• ✗

  Rely on remote wipe because the device will usually connect to the internet again.

  Why it's wrong here

  Remote wipe depends on the device establishing a future network connection, but a traveling employee's stolen laptop might be powered off, have its network card removed, or be kept offline by a sophisticated attacker. Meanwhile, the thief can pull the disk immediately and clone or read it without ever booting the OS, making the wipe moot. It is a useful reactive control, but it is unreliable as the primary protection because you cannot guarantee connectivity or even that the wipe command will execute before offline extraction.

Go deeper

Related to this question