A system administrator has been instructed by the head of security to protect their data at-rest. Which of the following would provide the strongest protection?

Prohibiting removable media is a policy control that reduces data exfiltration risk but does not encrypt or protect data already stored on the system's disks.

Full-disk encryption (FDE) such as BitLocker encrypts all data written to the disk, ensuring that even if the physical drive is removed or the device is lost, the data cannot be read without the correct credentials or encryption key. This is the most direct and strongest technical control for protecting data at rest because it addresses the confidentiality of the data itself. FDE operates transparently to authorized users and protects against theft, loss, and unauthorized physical access.

Biometric controls on data center entry points provide physical access control to the facility but do not protect data if the storage media is removed or accessed through other means.

A host-based intrusion detection system monitors for suspicious activity and generates alerts but does not encrypt or protect data at rest from unauthorized access.