Security · Topic 4 of 13
Defender, Firewall and Encryption
Configure Microsoft Defender Antivirus, Windows Defender Firewall, BitLocker, BitLocker To Go and the Encrypting File System to protect a Windows PC.
- 4 min
- Defender Antivirus uses real time protection and definition updates.
- The firewall has inbound and outbound rules and Domain, Private and Public profiles.
- Allowing an app through the firewall is done in the Windows Defender Firewall settings.
What it is
Windows includes built in tools to stop malware, filter network traffic and encrypt data. Together they cover the main threats to a workstation: malicious software, unwanted connections and lost or stolen storage. The technician must know what each one does and where it is configured.
How it works
Microsoft Defender Antivirus
Defender Antivirus is the built in antimalware engine. It scans files when they are opened (real time protection) and can run quick, full or custom scans. It relies on definition updates, which are the signatures it uses to recognise known threats, and these update through Windows Update.
Detected items are quarantined or removed. A user with enough rights can add exclusions, but each exclusion is a gap in protection. Most settings are in the Windows Security app, which also shows status for the firewall, account protection and device health.
Windows Defender Firewall
The firewall (also called Microsoft Defender Firewall in newer builds) filters traffic by rules. An inbound rule controls connections coming to the computer, and an outbound rule controls connections leaving it. By default, unsolicited inbound traffic is blocked and most outbound traffic is allowed.
| Task | How |
|---|---|
| Allow an app | Use Allow an app through firewall, and choose the Private or Public profile |
| Open a port | Create an inbound rule in Windows Defender Firewall with Advanced Security |
| Block a program | Create an outbound rule for that program |
The firewall keeps separate settings for the Domain, Private and Public profiles. The Public profile is the strictest. Turning the firewall off is rarely the right fix, because it removes a major layer of protection.
BitLocker
BitLocker encrypts an entire drive, so the data is unreadable if someone removes it and reads it elsewhere. It is available in Pro, Pro for Workstations and Enterprise. It works best with a Trusted Platform Module (TPM), a chip that holds the keys and checks that the boot process has not been changed.
Key points about BitLocker:
- A recovery key is created during setup. It must be saved somewhere safe, such as an account or a printed copy, because it unlocks the drive if the normal method fails.
- The user can also add a personal identification number (PIN) or a startup key on a Universal Serial Bus (USB) drive.
- Encryption protects data at rest, but not data that is open on a running, unlocked computer.
BitLocker To Go applies the same encryption to removable drives, such as USB flash drives. The user enters a password to open the drive.
Encrypting File System (EFS)
EFS encrypts individual files or folders for one user. It is set in a file's advanced properties and is tied to the user's account and certificate.
Other users cannot read the file, but an administrator who resets a password without the certificate can lock the owner out. Back up the EFS certificate and key.
Windows Security app
The Windows Security app gathers the protection settings in one place. It shows virus and threat protection, firewall and network protection, app and browser control, and device security. A yellow or red mark on an area means the setting needs attention, such as out of date definitions or a disabled firewall.
A technician can start a scan, check protection history and see quarantined items from here. If a third party antivirus is installed, Defender Antivirus normally turns itself off to avoid two scanners clashing.
BitLocker versus EFS
| Feature | BitLocker | EFS |
|---|---|---|
| Scope | Whole drive or volume | Selected files and folders |
| Tied to | The device, with TPM or password | A user account and certificate |
| Protects against | A lost or stolen drive | Other local users reading the file |
Save the BitLocker recovery key before encrypting. Without it, a drive that fails the normal unlock cannot be recovered.
What to remember for the exam
- Defender Antivirus uses real time protection and definition updates.
- The firewall has inbound and outbound rules and Domain, Private and Public profiles.
- Allowing an app through the firewall is done in the Windows Defender Firewall settings.
- BitLocker encrypts whole drives and works with a TPM.
- Save the BitLocker recovery key.
- BitLocker To Go protects removable drives.
- EFS encrypts files for one user and depends on that user's certificate.
- BitLocker needs Pro or above.
Common mistakes
Disabling the firewall to fix a connection. Create a specific allow rule instead.
Forgetting definition updates. An antivirus with old definitions misses new threats.
Losing the recovery key. The drive may stay locked forever.
Confusing BitLocker and EFS. BitLocker covers the drive. EFS covers selected files for one account.
Check yourself
Which feature encrypts a whole drive and uses the TPM?
BitLocker.
What protects a USB flash drive with a password?
BitLocker To Go.
Which firewall profile applies on a coffee shop network?
The Public profile, which is the most restrictive.
Topic 4 of 13 in Security
Test yourself on Security
The full CompTIA A+ 220-1202 question bank has 835 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.