220-1102 Question 351
Single answerMobile device management (MDM)A company issues smartphones to sales staff and manages them through a mobile device management (MDM) platform. One employee reports a company phone was left in a taxi and may contain customer email, saved documents, and access to cloud apps. The employee believes the phone is protected by a screen lock, but the IT administrator cannot confirm whether the device will be recovered. Which action should the administrator take FIRST through the MDM platform to best reduce the immediate risk of data exposure while preserving the option to recover the device later?
- A
Perform a remote wipe of the entire device immediately
- B
Issue a remote lock command and attempt to locate the device
- C
Remove the user's email account from the mail server
- D
Reset the user's cloud application passwords only
Show answer and explanation
Correct answer: B
Explanation
MDM platforms are designed to centrally enforce security actions on managed mobile devices, including remote lock, geolocation or device location (when configured and permitted), policy enforcement, and remote wipe. In a scenario where a device is lost but might still be recovered, the best first step is typically to remotely lock it and then attempt to locate or monitor it through the MDM console. This reduces immediate exposure without unnecessarily destroying data or eliminating recovery options. If recovery fails or the risk increases, the administrator can then escalate to a selective wipe or full device wipe depending on ownership model and company policy. This approach is consistent with common enterprise mobility management practices documented by major MDM vendors and mobile security guidance, which generally recommend securing access first, then determining whether stronger actions such as wipe are necessary.
- A. Incorrect.
This would remove data from the device, but it is not the best FIRST action if the device may still be recoverable and the administrator wants to preserve that possibility. In many MDM workflows, the preferred initial response is to lock the device and use location or check-in features if available. A full wipe is typically appropriate if the device is confirmed lost, stolen, or at high risk and recovery appears unlikely.
- B. Correct.
This is correct. A remote lock is an appropriate first response in an MDM-managed environment because it helps prevent unauthorized access immediately while still allowing the organization to attempt recovery. If the platform supports location services or device check-in, the administrator can use those capabilities to assess whether the phone can be recovered before escalating to a wipe. This aligns with common incident-response best practices for lost but potentially recoverable mobile devices.
- C. Incorrect.
This may reduce some access to corporate email, but it does not secure locally stored data already on the phone and does not address other business apps or cached documents. It is a partial action, not the best first MDM-based response to a potentially lost device containing multiple forms of company data.
- D. Incorrect.
Password resets can be useful if account compromise is suspected, but they do not immediately protect locally stored files or prevent access if the device already has active authenticated sessions, cached data, or offline content. This is not as direct or comprehensive as using the MDM platform to lock the device first.