Laptops used by field auditors hold client workpapers, and temporary files and swap space may contain sensitive fragments. If a laptop is stolen, no data on it can be readable. Which encryption level BEST meets this requirement?
Select an answer to reveal the explanation.
Short Explanation
Encrypting one folder is like locking your desk drawer and leaving the papers spread on top. Temp files and swap leak bits of everything. Full disk encryption locks the whole room, which is what you need when a laptop walks away.
Full Explanation
Full disk encryption encrypts every sector of the drive, including the operating system, temporary directories, hibernation files, and swap or page files. When the device is powered off or locked, data at rest is unreadable without the key, which is typically protected by a TPM combined with a PIN or password. This directly addresses theft, because fragments written outside the intended folders are still protected. File-level encryption protects only selected files or folders; applications and the operating system routinely write copies, caches, and fragments elsewhere, so sensitive content can remain readable on a stolen laptop. Transport encryption protects data while it moves between the laptop and a cloud service, but it does nothing for the copies stored locally on the drive. Database encryption protects records within one application's data store, leaving documents, exports, and temporary files unprotected. Exam caveat: full disk encryption protects data at rest when the device is off or locked; once a user is logged in, data is decrypted for use, so it does not protect against malware on a running system. Operational check: use endpoint management to report encryption status for every laptop, confirm recovery keys are escrowed centrally, and verify that hibernation is covered so encryption keys are not left exposed in memory images.