SY0-701 Question 213
Single answerSelection of effective controlsA healthcare company allows employees to use their own smartphones to access email and a patient scheduling application. After several devices were reported lost, an internal review found that some phones stored sensitive work data locally and did not enforce screen locks. Management wants a control that will reduce the risk of data exposure on personally owned devices while preserving the employees' privacy by avoiding full device monitoring or wiping personal content. Which control is the MOST appropriate?
- A
Deploy a mobile device management (MDM) solution with full-device enrollment and remote wipe for the entire phone
- B
Implement a mobile application management (MAM) solution with a separate secured work container for corporate apps and data
- C
Require network access control (NAC) to verify that smartphones are connected through the corporate wireless network before opening the scheduling application
- D
Install endpoint detection and response (EDR) agents on employee smartphones to continuously monitor all personal and business activity
Show answer and explanation
Correct answer: B
Explanation
The best answer is implementing MAM with a secured work container because the scenario is specifically about selecting an effective control that balances security and privacy in a BYOD environment. Security+ emphasizes choosing controls that match business and technical requirements rather than selecting the most restrictive option available. Containerization is commonly used to separate enterprise data from personal data, enforce policy on managed applications, and support selective wipe when a device is lost or an employee leaves the organization. This is more appropriate than full-device MDM when the business wants to avoid broad monitoring or deleting personal content. This approach aligns with widely accepted mobile security practices reflected in guidance such as NIST SP 800-124 Revision 2 on enterprise mobile device security, which discusses mobile management approaches and the need to tailor controls to organizational and privacy requirements.
- A. Incorrect.
This is not the MOST appropriate choice for the stated requirement. Full-device MDM can enforce strong controls such as screen lock, encryption checks, and remote wipe, but it is more invasive on personally owned devices and can create employee privacy concerns because it manages the entire device. In a BYOD scenario where the company specifically wants to avoid full device monitoring or wiping personal content, full-device enrollment is typically heavier than necessary.
- B. Correct.
This is correct. MAM with containerization is a strong fit for BYOD when the organization needs to protect corporate data without taking full control of the user's personal device. A secured work container can isolate business email and applications, require authentication policies such as PINs, restrict data sharing, and allow selective wipe of only corporate data if the device is lost. This directly addresses the risk of local storage of sensitive data while aligning with privacy requirements.
- C. Incorrect.
This is incorrect because NAC focuses on validating device posture or controlling network access, usually when devices connect to a managed network. It does not directly solve the core problem of protecting locally stored corporate data on lost devices, especially when employees may access cloud applications over cellular networks or from outside the office. Someone might choose this option because NAC is a valid access control, but it is not the best data protection control for this scenario.
- D. Incorrect.
This is incorrect because EDR is designed primarily for threat detection, investigation, and response on endpoints. It is not the best control for separating corporate and personal data on BYOD smartphones, and continuous monitoring of all activity would conflict with the stated privacy objective. This distractor is plausible because EDR improves visibility, but visibility alone does not provide the selective containment and wipe capability needed here.