220-1101 Question 285
Single answerEncryptionA small accounting firm issues laptops to employees who travel with client financial data stored locally. One employee reports a stolen laptop from their car. The drive password was strong, but management wants to reduce the risk of data exposure if another device is lost. Which solution should the technician recommend to best protect the data at rest on the laptops?
- A
Enable full-disk encryption such as BitLocker on each laptop
- B
Configure a host-based firewall on each laptop
- C
Require complex Windows login passwords and account lockout
- D
Install an antivirus application with real-time scanning
Show answer and explanation
Correct answer: A
Explanation
The key phrase in this scenario is "protect the data at rest" on laptops that may be lost or stolen. Best practice is to use full-disk encryption so the drive contents remain unreadable without the proper key or recovery method. For Windows laptops, BitLocker is the relevant example commonly associated with A+ objectives. Login passwords, firewalls, and antivirus are all useful controls, but they do not directly mitigate offline access to a stolen drive. This aligns with standard security guidance from Microsoft and general industry best practices: use device encryption/full-disk encryption to protect sensitive local data on portable systems.
- A. Correct.
Correct. Full-disk encryption protects data at rest by encrypting the contents of the drive so that if the laptop is lost or stolen, an attacker cannot easily read the files by removing the drive or booting from alternate media. In Windows environments, BitLocker is a standard full-volume encryption solution and is the most appropriate control for this scenario.
- B. Incorrect.
Incorrect. A host-based firewall helps control inbound and outbound network traffic, but it does not encrypt files stored on the laptop. If the device is stolen, a firewall does not prevent someone from accessing the drive's contents offline.
- C. Incorrect.
Incorrect. Strong login passwords improve access control during normal use, but they do not provide the same protection as disk encryption against offline attacks. An attacker can remove the drive, connect it to another system, or use other methods to bypass the operating system login and access unencrypted data.
- D. Incorrect.
Incorrect. Antivirus software helps detect and block malware, but it does not protect data at rest on a stolen device. It addresses malicious software threats, not unauthorized access to a physically lost or stolen drive.