220-1102 Question 548
Single answerEncryption settingsA technician is preparing several Windows 11 Pro laptops for a sales team that frequently travels with customer data stored locally. Management wants the data protected if a laptop is lost or stolen, but users should still be able to sign in normally without manually encrypting individual files. Which encryption setting should the technician configure to best meet this requirement?
- A
Enable BitLocker drive encryption on the system drive
- B
Enable EFS on each user's Documents folder
- C
Create password-protected ZIP archives for customer files
- D
Set NTFS permissions so only the assigned user can access the data
Show answer and explanation
Correct answer: A
Explanation
The best answer is to enable BitLocker drive encryption on the system drive. In Windows Pro environments, BitLocker is the standard full-volume encryption technology used to protect data at rest on laptops and other portable devices. This aligns with common security best practices for mobile endpoints because it helps prevent unauthorized access if a device is lost, stolen, or the drive is removed. EFS is a legitimate Windows encryption method, but it is file-based and better suited for selective encryption rather than broad endpoint protection. NTFS permissions are access controls, not encryption, and ZIP encryption is too manual and limited for enterprise laptop protection. Microsoft documentation identifies BitLocker as the primary Windows feature for full-drive encryption on supported editions, making it the most appropriate configuration in this scenario.
- A. Correct.
Correct. BitLocker provides full-disk encryption for Windows Pro editions and is designed to protect data at rest if the laptop is lost or stolen. It encrypts the entire system drive rather than requiring users to encrypt files individually. In a business laptop scenario, this is the most appropriate setting to protect locally stored data while allowing normal sign-in and transparent access for authorized users.
- B. Incorrect.
Incorrect. EFS encrypts files and folders at the file level, which can protect specific data, but it requires per-user configuration and management. It does not provide the same broad protection as full-disk encryption, and it is less ideal when the goal is to secure the entire laptop automatically. A candidate might choose this because it is also a Windows encryption feature, but it is not the best fit for the stated requirement.
- C. Incorrect.
Incorrect. Password-protected ZIP archives can encrypt specific files for transfer or storage, but this is a manual, user-dependent process and does not protect the whole system. It also creates workflow issues because users would need to remember to archive files consistently. This option reflects a common misconception that file archiving is a practical replacement for device-wide encryption.
- D. Incorrect.
Incorrect. NTFS permissions control access when the operating system is running normally and a user account is authenticated, but they do not protect data if someone removes the drive or boots from another environment. This is a common confusion between access control and encryption. Permissions are important, but they do not satisfy the requirement for lost-or-stolen device protection.