Which encryption method describes the encryption of all data on a disk, including system files, temporary files, and the pagefile, which can be implemented by the OS, third-party software, or at the disk controller level?

Which encryption method describes the encryption of all data on a disk, including system files, temporary files, and the pagefile, which can be implemented by the OS, third-party software, or at the disk controller level?

• A. Antivirus
• B. Configuration baselines
• C. Full disk encryption (FDE)
• D. Self-encrypting drives (SED)

Answer: (C)

Full disk encryption is the practice of encrypting every bit of data on a disk, so nothing on the disk can be read without the decryption key. This includes all data categories the system uses—operating system files, system areas, temporary files, and the pagefile—so data remains protected even if the device is off or stolen. The key point is that encryption happens for the entire disk, not just selected files or folders, which is why it covers the pagefile and temporary files as well as normal data. This protection can be provided in several ways: by the operating system itself (for example, BitLocker or FileVault), by third‑party encryption software, or by the disk hardware (self-encrypting drives) where the drive handles encryption internally. It’s this flexibility in implementation that makes full disk encryption the correct concept for describing encryption of all disk data, across different deployment methods. Antivirus and configuration baselines aren’t about encrypting data on disk, so they don’t fit. Self-encrypting drives are a hardware implementation of full disk encryption, so they’re a specific way to achieve FDE rather than the general method itself.

Full disk encryption is the practice of encrypting every bit of data on a disk, so nothing on the disk can be read without the decryption key. This includes all data categories the system uses—operating system files, system areas, temporary files, and the pagefile—so data remains protected even if the device is off or stolen. The key point is that encryption happens for the entire disk, not just selected files or folders, which is why it covers the pagefile and temporary files as well as normal data.

This protection can be provided in several ways: by the operating system itself (for example, BitLocker or FileVault), by third‑party encryption software, or by the disk hardware (self-encrypting drives) where the drive handles encryption internally. It’s this flexibility in implementation that makes full disk encryption the correct concept for describing encryption of all disk data, across different deployment methods.

Antivirus and configuration baselines aren’t about encrypting data on disk, so they don’t fit. Self-encrypting drives are a hardware implementation of full disk encryption, so they’re a specific way to achieve FDE rather than the general method itself.