One of the most basic ways to protect the confidentiality of data on a laptop in the event the device is physically stolen is to implement which of the following?

File-level encryption only protects specific files or folders, leaving the operating system, swap files, temporary files, and unencrypted files exposed if the drive is physically removed.

Biometric authentication secures login but does not protect data stored locally on the drive if the disk is extracted and read directly; cloud storage does not protect data that remains on the local drive.

Whole disk encryption (such as BitLocker) encrypts every sector of the drive, meaning data cannot be read even if the drive is removed and connected to another machine. Adding two-factor authentication ensures that knowing only a password is insufficient to unlock the drive, making brute force and credential theft attacks far less effective. This combination addresses both physical theft and credential compromise scenarios.

BIOS passwords can be bypassed by resetting CMOS or removing the drive and attaching it to another system, and they do not encrypt any data on the disk itself.