220-1102 Question 605
Single answer3.3 Given a scenario, troubleshoot common mobile OS and application security issues.A company uses Android tablets for field inspections. Several users report that after installing a free flashlight app from a third-party website, the tablets began showing frequent pop-up ads even when no browser is open. Battery life has dropped significantly, and one user noticed the app requested access to contacts, SMS messages, and device administration features during installation. Which action should the technician take FIRST to address the most likely security issue?
- A
Factory reset the tablets immediately to remove the application and restore performance
- B
Disable device encryption so the malicious app can be analyzed more easily
- C
Uninstall the suspicious application and revoke any elevated permissions or device administrator access it was granted
- D
Clear the browser cache and cookies because the pop-ups are most likely caused by stored web data
Show answer and explanation
Correct answer: C
Explanation
This scenario describes symptoms consistent with mobile malware or adware on Android, especially because the app was installed from a third-party site and requested excessive permissions unrelated to its stated function. A technician should first remove the suspicious app and revoke any special privileges, such as device administrator access, that could prevent removal. This aligns with standard mobile security best practices: install apps only from trusted sources, review app permissions carefully, and remove apps that show malicious behavior such as intrusive ads, abnormal battery drain, or unnecessary access to sensitive data. Android security guidance and enterprise mobile management best practices both emphasize limiting app installation sources and reviewing app permissions as key defenses against malicious software.
- A. Incorrect.
This is not the best first step. A factory reset may remove the malicious app, but it is more disruptive than necessary and can cause data loss or require full device reconfiguration. In a realistic support scenario, the technician should first remove the suspicious application and any elevated privileges it obtained. A reset may be appropriate later if the device remains compromised.
- B. Incorrect.
This is incorrect and would weaken security. Encryption protects data at rest and is not related to stopping adware or malicious mobile apps. Disabling encryption does not help remediate the infection and creates additional security risk.
- C. Correct.
This is correct. The scenario strongly suggests a malicious or unwanted app: it came from a third-party source, displays persistent ads, drains the battery, and requested excessive permissions including device administrator access. Best practice is to remove the app and revoke elevated privileges first, because some malicious Android apps use administrator privileges to resist uninstallation. This addresses the most likely cause directly and with the least disruption.
- D. Incorrect.
This is incorrect. While pop-ups can come from a browser, the key clues point to a malicious mobile app rather than normal web activity: ads appear even without a browser open, battery usage increased, and the app requested unrelated permissions. Clearing browser data would not address the root cause.