Sophia travels a lot and worries that her laptop containing confidential documents might be stolen. What is the best protection that will work for her?

Password-protected files only secure individual files the user explicitly locks, leaving the rest of the file system fully readable to anyone with physical access.

Hidden folders rely on security through obscurity and are visible to any attacker using basic directory listing tools or a different OS.

A BIOS password can be reset by removing the CMOS battery, and it does not prevent an attacker from removing the hard drive and reading it in another machine.

Full disk encryption (FDE), such as BitLocker or FileVault, encrypts every sector of the drive using a key tied to the user's credentials or a TPM chip. If the laptop is stolen, the attacker cannot read any data without the decryption key, even by booting from external media or transplanting the drive to another system. This is the only option that provides comprehensive at-rest data protection regardless of how the disk is accessed.