Legacy Haven University

A stolen drive still holds every file on it unless the technician encrypted the data first. CompTIA A+ Core 2 (220-1202) groups three Windows controls for that job under objective 2.2: BitLocker, BitLocker-To-Go, and Encrypting File System (EFS). Objective 2.7 then lists data-at-rest encryption as a workstation hardening step. This article maps those named items and stops where the official list stops.

Security is 28% of 220-1202, tied with Operating Systems. Encryption questions sit next to Defender Antivirus, the Windows Firewall, User Account Control (UAC), NTFS versus share permissions, and Active Directory. Study the scope of each control. Do not mix a full-volume lock with a single-file lock.

The study path for the rest of Core 2 lives on the A+ Core 2 hub.

What 220-1202 actually names

2.2 — Given a scenario, configure and apply basic Microsoft Windows OS security settings lists:

• BitLocker
• BitLocker-To-Go
• Encrypting File System (EFS)

No sub-bullets. No algorithm names. No command names.

1.3 — Compare and contrast basic features of Microsoft Windows editions lists BitLocker again under feature differences, beside domain versus workgroup, Remote Desktop Protocol (RDP) availability, RAM support limits, and gpedit.msc. Windows 10 editions on the list: Home, Pro, Pro for Workstations, Enterprise. Windows 11 editions on the list: Home, Pro, Enterprise. The objectives do not state which edition includes which encryption feature.

1.3 hardware requirements list Trusted Platform Module (TPM) and Unified Extensible Firmware Interface (UEFI). TPM is a hardware chip that holds cryptographic material. UEFI is the modern firmware interface that replaced the older Basic Input/Output System (BIOS). The objectives do not say BitLocker depends on TPM.

2.7 — Given a scenario, apply workstation security options and hardening techniques lists data-at-rest encryption as the first bullet. Data at rest means data sitting on a disk, not data moving across a network.

2.8 lists device encryption for mobile hardening. Keep that on the mobile objective. This article stays on the Windows 2.2 / 2.7 set.

BitLocker: volume-scope data at rest

BitLocker encrypts a volume. A volume is a formatted storage space the operating system mounts as a drive letter. After BitLocker turns on, the plaintext files do not sit on the disk. An attacker who removes the drive and mounts it on another machine reads ciphertext unless that person also holds a valid protector.

That is the exam distinction. BitLocker protects the whole volume. It does not replace NTFS permissions. It does not replace a login password. It answers one question: if the disk leaves the chassis, can a stranger read the files?

Pair BitLocker with the other 2.7 controls the exam lists in the same objective: BIOS/UEFI passwords, account lockout, disabled guest accounts, disabled AutoRun, and disabled unused services. Encryption without those steps still leaves a running, logged-on workstation open.

BitLocker-To-Go: the same idea on removable media

BitLocker-To-Go is the named control for removable media. USB flash drives and external disks leave the building. 2.7 also tells the technician to secure and protect critical hardware such as laptops. A packed USB drive is the same class of problem: the media walks.

BitLocker-To-Go encrypts that removable volume. A lost stick then holds ciphertext. The exam lists BitLocker and BitLocker-To-Go as separate 2.2 items. Treat them as two scopes:

EFS: file-scope encryption on the live OS

Encrypting File System (EFS) encrypts selected files and folders. BitLocker locks the volume. EFS locks objects inside the volume while the volume is already unlocked and Windows is running.

That split matters on a shared workstation. Two standard accounts can sit on the same NTFS volume. NTFS permissions (objective 2.2) control who may open a folder. EFS adds a second lock on the file contents. A second local account that somehow reaches the file still reads ciphertext unless that account holds the EFS credentials for that file.

2.2 places EFS in the same list as:

• NTFS versus share permissions
• File and folder attributes
• Inheritance
• Run as administrator versus standard user
• User Account Control (UAC)

Study EFS as part of that Windows permission and identity cluster, not as a second BitLocker.

How the three controls differ in one picture

Think in layers. Do not memorize vendor white papers the exam never named.

1. The chassis and firmware: 2.1 physical security, plus 2.7 BIOS/UEFI passwords. TPM and UEFI appear as 1.3 hardware requirements.
2. The volume: BitLocker on the fixed disk. BitLocker-To-Go on the USB disk. Both serve 2.7 data-at-rest encryption.
3. The live session: username and password, PIN, fingerprint, facial recognition, single sign-on (SSO), passwordless / Windows Hello, UAC, NTFS permissions.
4. The individual file: EFS.

A technician who only turns on BitLocker still has an unlocked volume after a valid logon. A technician who only turns on EFS still leaves every unencrypted file readable if the disk is imaged from outside Windows. The exam can ask either miss.

TPM on this exam — keep the mapping honest

Distribution notes for this slot mention a short TPM breakdown. Stay inside 1.3.

TPM means Trusted Platform Module. 220-1202 lists it as a Windows hardware requirement next to UEFI. The acronym list in the same official document defines TPM as Trusted Platform Module and also defines HSM as Hardware Security Module. Those are two different named items. Do not swap them.

The official 2.2 BitLocker line does not attach TPM. A question that says “hardware requirement for the Windows edition” points at 1.3. A question that says “configure Windows OS security settings for a volume or a USB drive” points at 2.2 BitLocker or BitLocker-To-Go. A question that says “encrypt one folder for one user” points at EFS.

Workstation hardening that sits beside encryption

2.7 does not stop at data-at-rest encryption. After you can name BitLocker and EFS, walk the rest of that objective so a scenario question cannot trap you:

• Password length, character types, uniqueness, complexity, and expiration
• BIOS/UEFI passwords
• Screensaver locks, logoff when idle, timeout / screen lock
• Protect laptops and other critical hardware
• Protect personally identifiable information (PII) and passwords
• Password managers
• Restrict user permissions and log-in times
• Disable the guest account
• Failed-attempts lockout
• Account expiration dates
• Change the default administrator account and password
• Disable AutoRun
• Disable unused services

Encryption is one control in that list. It is not the whole list.

What to do on a 220-1202 item

Read the object the prompt wants protected.

• Entire internal volume, disk pulled from the PC → BitLocker; 2.7 data-at-rest encryption.
• USB or external disk that leaves the site → BitLocker-To-Go.
• One folder on a shared Windows disk, second local user must not read the bytes → EFS.
• Edition feature comparison that includes BitLocker next to RDP or gpedit.msc → 1.3.
• Firmware chip required for the Windows install → TPM under 1.3 hardware requirements.

Do not spend study time on key-wrap diagrams the objectives never print. Spend it on scope.