220-1102 Question 224
Single answerDriveA technician is preparing a Windows 11 laptop for a traveling employee who stores confidential client files locally. The employee wants the data protected if the laptop is lost or stolen, but also needs to continue using the laptop normally without manually encrypting individual folders. The laptop has a TPM 2.0 chip and the Windows edition supports full-disk encryption. Which solution should the technician implement?
- A
Enable BitLocker on the system drive
- B
Compress the user's Documents folder with NTFS compression
- C
Convert the drive to FAT32 for broader compatibility
- D
Create a hidden partition for confidential files
Show answer and explanation
Correct answer: A
Explanation
The best solution is to enable BitLocker on the system drive because the scenario specifically requires protection for locally stored confidential data in the event of loss or theft, while still allowing transparent everyday use. In Windows, BitLocker is the standard full-volume encryption feature for protecting data at rest, and TPM 2.0 is commonly used to enhance key protection and streamline startup. NTFS compression addresses storage efficiency, not confidentiality. FAT32 reduces security and management capabilities compared to NTFS. Hidden partitions provide obscurity, not cryptographic protection. This aligns with Microsoft best practices for device encryption and full-disk protection on supported Windows systems.
- A. Correct.
Correct. BitLocker provides full-disk encryption for Windows drives and is designed to protect data at rest if a device is lost or stolen. With TPM 2.0 support, the laptop can securely store encryption-related information and allow the user to continue normal day-to-day operation with minimal interaction. This meets the requirement to protect the entire drive rather than relying on the user to manually encrypt individual files.
- B. Incorrect.
Incorrect. NTFS compression reduces disk space usage; it does not provide security or encryption. A common misconception is that making files less accessible or changing how they are stored somehow protects confidentiality, but compressed files remain readable to anyone with access to the system.
- C. Incorrect.
Incorrect. FAT32 does not provide native Windows file permissions like NTFS and does not offer full-disk encryption. Converting to FAT32 would reduce functionality and security, and it would not address the requirement to protect confidential data if the laptop is stolen.
- D. Incorrect.
Incorrect. A hidden partition is not a security control for sensitive data. It may obscure data from casual view, but anyone with basic disk tools can discover and access the partition. This reflects the misconception that hiding data is equivalent to encrypting it.