220-1102 Question 518
Single answerMDMA company issues smartphones to its sales team and uses a mobile device management (MDM) platform to enforce security policies. One salesperson reports that their company email stopped syncing after they disabled the screen lock because they found it inconvenient. The phone is personally owned but enrolled to access corporate resources. The technician needs to restore email access while keeping company data protected. What is the BEST action to take?
- A
Re-enroll the phone in the MDM and explain that a passcode or screen lock is required to meet the corporate compliance policy
- B
Factory reset the phone so the email profile can be recreated from scratch
- C
Install a third-party antivirus app to satisfy the MDM security requirement
- D
Root the device so the MDM agent can bypass the user’s personal settings
Show answer and explanation
Correct answer: A
Explanation
MDM platforms are used to enforce security baselines on mobile devices that access organizational data, especially in bring-your-own-device environments. A common policy is requiring a screen lock before allowing access to managed email, apps, or data. If a user disables that control, the device may be marked noncompliant and access can be revoked automatically until the policy is satisfied again. The best practice is to restore compliance by reapplying or re-enrolling the device in MDM as needed and ensuring the required passcode or screen lock is enabled. This aligns with standard mobile security guidance from enterprise mobility and identity platforms such as Microsoft Intune and similar MDM solutions, which commonly use compliance policies to gate access to email and other corporate resources.
- A. Correct.
This is correct. In an MDM-managed BYOD scenario, access to corporate resources such as email is commonly tied to compliance policies, including requiring a screen lock, passcode, PIN, or biometric protection backed by a device unlock method. If the user disables the screen lock, the device can become noncompliant and lose access to managed resources. Re-enrollment or reapplying policy, combined with educating the user about the required lock setting, is the most appropriate and least disruptive fix.
- B. Incorrect.
This is incorrect. A factory reset is excessive for a device that simply fell out of compliance with an MDM policy. It would disrupt the user unnecessarily and is not the standard first response when a managed device loses email access due to a disabled lock screen. The issue is policy compliance, not corruption of the email profile.
- C. Incorrect.
This is incorrect. Antivirus software does not replace the requirement for a device passcode or screen lock in MDM compliance rules. A candidate might choose this if they confuse general mobile security tools with specific MDM-enforced access conditions. The reported problem is directly related to disabling the lock screen, not malware protection.
- D. Incorrect.
This is incorrect. Rooting a device weakens security, typically violates organizational policy, and often causes a device to be blocked by MDM solutions rather than accepted. MDM is designed to enforce policy within supported security controls, not bypass them. Rooting would make the situation worse and increase risk to corporate data.