D420 behaves exactly like the D430 in every respect. So password is required to avoid KP at wake but, as reminded by Bronx, if BIOS is configured as per published recommended settings, you'll "only" have to enter system password at cold boot and restart, not on wake.