220-1102 Question 471
Single answer2.7 Given a scenario, apply workstation security options and hardening techniques.A company allows employees to work remotely on Windows 11 laptops that contain sensitive customer data. Several users have reported that family members occasionally use the same laptops at home, and management is concerned that data could be exposed if a device is lost or someone boots from external media to bypass the operating system. The company wants a solution that protects data at rest and strengthens startup security with minimal impact on user workflow. Which of the following should the technician implement FIRST?
- A
Enable BitLocker with TPM and require a pre-boot PIN
- B
Disable the guest account and enforce strong password complexity
- C
Configure NTFS permissions so only the employee can access the Documents folder
- D
Enable a host-based firewall and block inbound SMB connections
Show answer and explanation
Correct answer: A
Explanation
The best first step is to enable BitLocker with TPM and a pre-boot PIN because the scenario specifically mentions protection against device loss, data exposure at rest, and attempts to bypass the operating system by booting from external media. Full-disk encryption is a standard best practice for laptops containing sensitive data. Microsoft documents BitLocker as a feature that helps protect data from unauthorized access on lost, stolen, or improperly decommissioned devices, and TPM-based protection helps verify system integrity during startup. Requiring a startup PIN adds another factor before the encrypted drive can be unlocked. Other measures like strong passwords, account restrictions, file permissions, and host firewalls are useful hardening controls, but they do not address offline attacks as effectively as full-disk encryption.
- A. Correct.
Correct. BitLocker is designed to protect data at rest by encrypting the drive, which helps if the laptop is lost or stolen. Using TPM ties the encryption to the device's trusted hardware, and adding a pre-boot PIN strengthens startup security by requiring user authentication before the OS loads. This directly addresses the risk of someone removing the drive or booting from external media to access data offline. This is a workstation hardening control specifically aligned with protecting mobile devices that store sensitive information.
- B. Incorrect.
Incorrect. Disabling the guest account and enforcing strong passwords are good security hardening measures, but they do not adequately protect data if someone has physical access to the laptop or boots from alternate media. Password policies mainly protect OS logon access, not offline access to an unencrypted drive.
- C. Incorrect.
Incorrect. NTFS permissions help control access within Windows after the operating system has booted and authenticated a user. However, they do not protect the data if the drive is accessed from another operating system, attached to another computer, or read through offline tools. This is a common misconception when physical device theft is part of the threat model.
- D. Incorrect.
Incorrect. A host-based firewall is important for reducing network attack surface and limiting unauthorized inbound connections, but it does not protect data stored on the laptop from physical theft or offline access. The scenario is focused on data-at-rest protection and startup hardening, not primarily on network exposure.