CISSP Practice Question: Wants to protect sensitive data stored on laptops

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  BIOS password

  Why it's wrong here

  A BIOS password primarily secures the boot process, preventing unauthorized users from booting the operating system or altering system settings without authentication. However, it does not encrypt or protect the data stored on the hard drive itself. An attacker can easily bypass this control by physically removing the hard drive from the laptop and connecting it to another computer, thereby gaining direct, unhindered access to all unencrypted sensitive data. This makes it an insufficient control for data confidentiality in case of physical theft.

• ✗

  Asset tracking software

  Why it's wrong here

  Asset tracking software is designed to monitor the physical location and inventory status of devices, aiding in recovery efforts or inventory management. While it can help an organization attempt to locate a stolen laptop, it provides no direct mechanism to prevent an unauthorized individual from accessing the sensitive data stored on the device once it is physically compromised. The software does not encrypt data or restrict access to the storage medium, thus failing to address the core requirement of data confidentiality.

• ✓

  Full-disk encryption (FDE)

  Why this is correct

  Full-disk encryption (FDE) provides comprehensive data protection by encrypting all data stored on the entire hard drive, including the operating system, applications, and user files. This ensures that even if a stolen laptop's hard drive is removed and connected to another system, the data remains unreadable and inaccessible without the correct decryption key or passphrase. FDE is a robust control for protecting data at rest, making it the most effective solution for preventing unauthorized access to sensitive information on a lost or stolen device.

• ✗

  Remote wipe capability

  Why it's wrong here

  Remote wipe capability allows an organization to remotely erase all data from a lost or stolen device, preventing data compromise. However, this functionality is entirely dependent on the device establishing a network connection (e.g., Wi-Fi or cellular data) to receive the wipe command. If a stolen laptop is kept offline by the thief, or if its network connectivity is disabled, the remote wipe command will never be received or executed, leaving the sensitive data vulnerable indefinitely. This inherent dependency makes it an unreliable primary control for immediate data protection post-theft.

Go deeper

Related to this question