220-1102 Question 609
Single answerRoot access/jailbreakA company issues smartphones to field technicians and manages them with a mobile device management (MDM) platform. One technician reports that a company iPhone can now install apps from unofficial sources and several built-in security restrictions no longer appear to be enforced. Company policy requires that devices with compromised operating system protections be removed from service immediately. Which action should the technician perform FIRST?
- A
Back up the device and apply the latest iOS update to restore the missing restrictions
- B
Remove the device from the corporate network and report it as jailbroken to IT/security
- C
Factory reset the phone and return it to the user if the issue does not reappear
- D
Disable Bluetooth and Wi-Fi and continue using cellular data until IT can review the device
Show answer and explanation
Correct answer: B
Explanation
This question tests recognition of a jailbroken mobile device and the proper first response in a business environment. On A+ Core 2, root access and jailbreak concepts are tied to mobile device security risks and policy enforcement. Jailbreaking on iOS removes manufacturer-imposed restrictions and can weaken application sandboxing, code-signing protections, and enterprise controls. In a managed environment, the correct initial action is containment: disconnect the device from company access and escalate it to IT/security. Remediation steps such as wiping, reenrolling in MDM, or replacing the device may follow, but they come after the device has been isolated. This is consistent with common security best practices and enterprise mobile management guidance from platform vendors and security frameworks, which emphasize identifying compromised devices, blocking their access, and handling them through documented incident response procedures.
- A. Incorrect.
Incorrect. Updating iOS may remove some jailbreaks in certain cases, but the first priority is containment. A device that appears jailbroken has reduced security controls and may not be trustworthy on the corporate environment. Backing it up first could also preserve unauthorized software or data. In an enterprise setting, the immediate response is to isolate and escalate according to policy.
- B. Correct.
Correct. A jailbroken iPhone bypasses Apple's built-in security restrictions, which increases the risk of malware, unauthorized access, and policy violations. The best first step is to remove the device from the corporate network and report it to IT/security or the MDM administrator for proper handling. This aligns with standard incident response practice: contain the risk before attempting remediation.
- C. Incorrect.
Incorrect. A factory reset may be part of remediation, but it is not the first action when a potentially compromised mobile device is still associated with company resources. The device should be isolated and reported first so IT can document the incident, preserve evidence if needed, and determine whether additional actions are required through MDM or security procedures.
- D. Incorrect.
Incorrect. Disabling Bluetooth and Wi-Fi does not adequately contain the risk. The phone could still communicate over cellular data, and the core issue is that the device's trusted security model may be compromised. Continuing to use the phone would violate the stated company policy and could expose corporate data.