The correct answer is C - Implementing local drive encryption on employee laptops.
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that encryption protects sensitive data at rest, ensuring that if a laptop is lost or stolen, the data remains unreadable without the decryption key.
This control directly addresses the protection of sensitive customer data.
Restricting software installation (A) is a good security practice but does not specifically protect stored sensitive data. Biometric authentication (B) strengthens authentication but does not encrypt data. Awareness training (D) helps users behave securely but does not technically protect the data itself.
Reference Extract from Study Guide:
"Local drive encryption protects sensitive data stored on mobile devices such as laptops, ensuring confidentiality even if the device is lost or stolen."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Endpoint Security and Device Hardening