220-1102 Question 397
Single answerAdvanced Encryption Standard (AES)A small accounting firm issues Windows 11 laptops to employees who frequently travel with client financial data stored locally. Management wants to protect the data if a laptop is lost or stolen, while keeping the impact on user workflow as low as possible. A technician enables BitLocker on the laptops and is asked which encryption standard is being used to provide the underlying data protection. Which of the following best answers the technician's question?
- A
AES, which is commonly used by full-disk encryption solutions such as BitLocker
- B
RSA, which is the standard symmetric algorithm used to encrypt the entire drive sector by sector
- C
SHA-256, which encrypts the drive contents and allows recovery if the laptop is stolen
- D
TKIP, which is the preferred encryption method for modern Windows full-disk encryption
Show answer and explanation
Correct answer: A
Explanation
The best answer is AES because the scenario describes protecting data at rest on Windows 11 laptops using BitLocker, which relies on AES-based encryption for full-volume protection. For A+ Core 2 purposes, candidates should recognize AES as the modern standard for efficient symmetric encryption in practical endpoint security scenarios, including full-disk encryption. By contrast, RSA is asymmetric and not used for bulk disk encryption, SHA-256 is a hash rather than an encryption method, and TKIP is a legacy wireless security protocol component rather than a disk-encryption standard. Microsoft BitLocker documentation and common security best practices consistently identify AES as the appropriate underlying encryption standard for protecting stored data on endpoint devices.
- A. Correct.
Correct. AES (Advanced Encryption Standard) is a symmetric block cipher widely used for data encryption, including full-disk encryption technologies. In Windows environments, BitLocker uses AES-based encryption to protect data at rest. This fits the scenario because the goal is to secure locally stored client data on lost or stolen laptops with minimal impact to users.
- B. Incorrect.
Incorrect. RSA is an asymmetric algorithm primarily used for key exchange, digital signatures, and protecting small pieces of data such as encryption keys. It is not the standard algorithm used to encrypt an entire drive sector by sector in BitLocker. A common misconception is that any well-known encryption algorithm can be used interchangeably for disk encryption, but full-disk encryption typically relies on efficient symmetric encryption such as AES.
- C. Incorrect.
Incorrect. SHA-256 is a hashing algorithm, not an encryption algorithm. It can be used for integrity checking, password storage workflows, and digital signature processes, but it does not decrypt data and is not used to encrypt drive contents for normal file access. Test takers may confuse hashing with encryption because both are used in security contexts.
- D. Incorrect.
Incorrect. TKIP is related to older wireless security implementations, particularly as a legacy improvement over WEP in Wi-Fi environments. It is not used for Windows full-disk encryption. Someone might pick this option if they associate 'encryption' broadly with any security technology, but TKIP is not relevant to BitLocker drive protection.