To protect corporate data on removable media, a security policy should mandate that all removable devices use which of the following?

Full disk encryption - such as BitLocker To Go - encrypts every byte stored on a removable device at the hardware or volume level. If the device is lost, stolen, or accessed without authorization, the data is cryptographically protected and unreadable, directly addressing the risk of data exposure from portable media.

Application isolation limits how applications interact with each other or the OS on a host system and provides no protection for data stored on a removable device used outside that host.

Digital rights management controls usage permissions such as copying or printing of specific files, but it does not protect the entire storage volume and can be bypassed if the underlying media is accessed directly.

Data Execution Prevention (DEP) is a memory protection feature that prevents code from executing in non-executable memory regions and has no bearing on protecting data stored on removable media.