An IS auditor is evaluating endpoint controls on a fleet of corporate laptops that store regulated client data. The chief information security officer states that full-disk encryption is enabled on every device. From an audit perspective, what does full-disk encryption PRIMARILY protect against?
- AUnauthorised reading of files by a malicious process running under a logged-on user that already has access to the mounted volume
- BDisclosure of data on a laptop that is lost or stolen while the device is powered off and the encryption key is not resident in memory Correct
- CExfiltration of structured data over the network by an authenticated user who copies records into a webmail attachment from the running endpoint
- DTampering with operating system binaries by malware that elevates privileges on the running endpoint after a successful phishing attack
Why A is wrong: Once a legitimate user has unlocked the volume, the operating system serves cleartext to authorised processes, so a malicious process running with that user's rights sees the same data as the user; full-disk encryption is transparent to the live session and does not address this.
Why B is correct: Full-disk encryption renders the sectors on the storage medium unreadable without the key, which is unlocked at boot using a credential, so a powered-off lost or stolen device cannot be read by an attacker who removes the disk or boots from external media.
Why C is wrong: Network exfiltration by an authenticated user is the domain of data loss prevention controls and egress filtering; full-disk encryption operates on the storage layer and provides no inspection of outbound content from a running, unlocked endpoint.
Why D is wrong: Integrity of running binaries is addressed by secure boot, application allow-listing and endpoint detection and response; full-disk encryption preserves confidentiality of at-rest data and does not measure or prevent in-memory tampering.