220-1102 Question 459
Single answerBring your own device (BYOD)A company allows employees to use personal smartphones and tablets to access corporate email and cloud storage under a bring your own device (BYOD) policy. After a sales representative reports a lost personal phone, management wants to reduce the risk of company data exposure without giving IT full control over employees' personal data and apps. Which solution BEST meets this requirement?
- A
Require all personal devices to be factory reset before they can reconnect to company services
- B
Implement mobile device management (MDM) with a separate corporate container that can be selectively wiped
- C
Disable screen locks on personal devices so IT can access them quickly during incidents
- D
Allow access only through public webmail so no configuration is stored on the device
Show answer and explanation
Correct answer: B
Explanation
The best answer is to implement MDM with a corporate container or work profile that supports selective wipe. In a BYOD environment, organizations commonly need to balance security with employee privacy. Containerization allows business email, documents, and managed apps to be isolated from personal photos, messages, and apps. If a device is lost, IT can remove only the corporate data instead of wiping the employee's entire phone. This approach aligns with standard BYOD best practices such as enforcing passcodes, encryption, remote lock, and limited administrative control over personal devices. CompTIA A+ Core 2 objectives commonly emphasize BYOD policy enforcement, security controls for mobile devices, and the distinction between managing corporate data versus taking ownership of the entire personal device.
- A. Incorrect.
Incorrect. A factory reset removes all data from the user's personal device, which is far more intrusive than the scenario allows. It may be appropriate in some high-security or company-owned device situations, but it does not align with a BYOD requirement to avoid full control over personal data and apps.
- B. Correct.
Correct. MDM with containerization or work profiles separates corporate data from personal data on BYOD devices. This lets IT enforce policies such as encryption, PINs, and managed app access for business data while performing a selective wipe of only corporate content if the device is lost or the employee leaves. This is a common best practice for BYOD environments.
- C. Incorrect.
Incorrect. Disabling screen locks would weaken device security and increase the risk of unauthorized access if a device is lost or stolen. BYOD programs typically require strong screen locks, not the removal of them. This option reflects a misunderstanding of incident response versus preventive security controls.
- D. Incorrect.
Incorrect. Public webmail may reduce some locally stored configuration, but it does not adequately address the broader need to control corporate data on BYOD devices. Browsers can still cache data, users may download files, and this approach does not provide selective wipe, policy enforcement, or managed access to corporate storage.