After copying a sensitive document from his desktop to a flash drive, Joe, a user, realizes that the
document is no longer encrypted. Which of the following can a security technician implement to ensure
that documents stored on Joe’s desktop remain encrypted when moved to external media or other
network based storage?

A.
Whole disk encryption

B.
Removable disk encryption

C.
Database record level encryption

D.
File level encryption

Explanation:
Encryption is used to ensure the confidentiality of information. In this case you should make use of file
level encryption. File level encryption is a form of disk encryption where individual files or directories are
encrypted by the file system itself. This is in contrast to full disk encryption where the entire partition or
disk, in which the file system resides, is encrypted.
Incorrect Answers:
A: Full disk encryption can be used to encrypt an entire volume with 128-bit encryption. When the entire
volume is encrypted, the data is not accessible to someone who might boot another operating system in
an attempt to bypass the computer’s security. Full disk encryption is sometimes referred to as hard drive
encryption. This would be best to protect data that is at rest.
B: Removable disk encryption will be used to prevent unauthorized access to data storage, but is does not
replace file encryption in all situations.
C: Database record level encryption is not going to ensure that Joe’s desktop’s documents will remain
encrypted when moved since Joe might have many other types of files other than database files.

Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis,
2014, pp. 59, 237, 290