A sales manager leaves a laptop in a taxi, and the same week a database administrator exports the customer table to a personal cloud drive at 2 a.m. Both are confidentiality incidents involving stored data. Full-disk encryption turns the first one into a non-event and does nothing at all about the second.
On the CompTIA Security+ SY0-801 exam, encryption levels sit under objective 1.3, which expects you to match a cryptographic solution to the problem it solves. This lesson walks through each level where data at rest can be encrypted, from the whole disk down to a single record, and shows how a scenario's threat tells you which level is the right answer.
The level you encrypt at decides who the encryption stops
Most encryption at rest is transparent. Once the right key is loaded, the system decrypts data automatically for any process allowed to read it, and users never see ciphertext. That convenience defines the protection: encryption only stops someone who reaches the data while it is still locked, or who doesn't hold the key at that moment.
Lower levels unlock early and broadly. A full-disk key is loaded at boot, and from then on everything on the drive is readable to the operating system and anything running on it. Higher levels unlock late and narrowly. A column key might be released only to one application, so even the server's administrators see ciphertext. The general rule: the lower the level, the more data it covers and the fewer threats it stops once the system is running.
| Level | Example tools | Unlocked when | Mainly stops |
|---|---|---|---|
| Full disk | BitLocker, FileVault, LUKS, self-encrypting drives | At boot | Theft of a powered-off device |
| Partition or volume | BitLocker data drives, BitLocker To Go, VeraCrypt | When mounted | Theft of that drive or volume |
| File | EFS, encrypted archives, GPG | When the owning user opens it | Other users on the same system, copies sent elsewhere |
| Database | Transparent data encryption (TDE) | When the database starts | Stolen data files and backups |
| Record or column | Always Encrypted, application-level encryption | When an authorized app requests a value | Privileged insiders, database server compromise |
Full-disk encryption protects a device that is lost or stolen while powered off
Full-disk encryption (FDE) encrypts everything on the drive: the operating system, applications, user files, the page file, the hibernation file and temporary files. That last part matters, because sensitive data leaks into places users never think about. The major tools are BitLocker on Windows, FileVault on macOS and LUKS on Linux. All three use AES, typically in XTS mode, a mode designed for disk sectors. Self-encrypting drives (SEDs) do the same job inside the drive's own controller.
The key has to come from somewhere at boot. BitLocker usually seals its key to the computer's TPM, which releases it only if the boot process hasn't been tampered with, and it can add a PIN typed before Windows starts. If the TPM refuses, the user is asked for a 48-digit recovery password, which organizations escrow in Active Directory or Microsoft Entra ID. The status of a protected drive looks like this:
PS C:\> manage-bde -status C:
Volume C: [OS]
Size: 475.69 GB
Conversion Status: Used Space Only Encrypted
Percentage Encrypted: 100.0%
Encryption Method: XTS-AES 128
Protection Status: Protection On
Lock Status: Unlocked
Key Protectors:
TPM
Numerical Password
Notice the lock status. While the laptop is running and logged in, the drive is unlocked for the operating system, so malware, a remote attacker or anyone at the unlocked session reads files in plaintext. FDE protects against physical loss of a powered-off device and against someone pulling the drive and reading it in another machine. A laptop stolen while asleep is weaker, because the key is still in memory. Pre-boot PINs, and hibernation or shutdown instead of sleep, close much of that gap.
On the exam, a lost or stolen laptop, phone or drive points to FDE. Many breach notification laws also treat a lost device differently if its data was encrypted and the key wasn't exposed, often removing the duty to notify, which is one reason FDE is usually the first encryption control an organization deploys.