220-1102 Question 216
Single answerFeaturesA small business uses Windows 11 Pro laptops for remote staff. A user tells the technician that they frequently work from hotel Wi-Fi and need a way to protect company data if the laptop is lost or stolen. Management also wants a solution built into Windows that can be centrally managed and does not require replacing the existing internal SSD. Which Windows feature should the technician recommend?
- A
BitLocker Drive Encryption
- B
Microsoft Defender Firewall
- C
Encrypting File System (EFS)
- D
NTFS permissions
Show answer and explanation
Correct answer: A
Explanation
The best answer is BitLocker Drive Encryption because the scenario focuses on protecting company data if the laptop is lost or stolen. That is a data-at-rest problem, and BitLocker is the Windows feature specifically intended to address it through full-volume encryption. This aligns with Microsoft best practices for protecting devices used outside the office, especially on portable systems. Defender Firewall is important for network protection, but it does not secure stored data. EFS is a real Windows encryption feature, but it is file-level rather than full-disk encryption, making it less effective and less manageable for this scenario. NTFS permissions provide access control within the operating system but are not a substitute for encryption. Microsoft documentation for BitLocker and Windows security guidance consistently positions BitLocker as the preferred built-in feature for protecting data on lost or stolen Windows Pro devices.
- A. Correct.
Correct. BitLocker Drive Encryption is a Windows feature designed to encrypt entire volumes, helping protect data if a device is lost or stolen. On Windows 11 Pro, BitLocker is an appropriate built-in feature for protecting data at rest and can be managed through enterprise tools such as Group Policy, making it a practical choice for business deployments.
- B. Incorrect.
Incorrect. Microsoft Defender Firewall helps control inbound and outbound network traffic and reduce network-based threats, but it does not encrypt the laptop's stored data. A stolen laptop's drive could still be accessed if only the firewall is enabled.
- C. Incorrect.
Incorrect. Encrypting File System (EFS) encrypts individual files and folders rather than the entire drive. While EFS can protect selected data, it is generally less suitable than BitLocker for full-device theft scenarios and broad company standardization. Candidates may choose this because it is also an encryption feature, but it does not provide the same whole-drive protection.
- D. Incorrect.
Incorrect. NTFS permissions control which users and groups can access files and folders within Windows, but they do not encrypt the data. If an attacker removes the drive or bypasses the installed OS, NTFS permissions alone do not provide the same protection as full-disk encryption.