312-50 exam dumps: questions 401 to 473 of 473

Correct answer: A

• A. Correct.

  Correct. In a legitimate assessment, a common and practical way to bypass jailbreak detection is to instrument the app at runtime using a framework such as Frida. Many iOS apps implement jailbreak checks by calling APIs or evaluating indicators such as suspicious file paths (for example, Cydia-related paths), the ability to write outside the sandbox, URL scheme checks, or process/environment artifacts. Hooking these functions and forcing benign return values allows the tester to continue dynamic analysis without permanently modifying the app binary. This reflects real-world mobile app testing practice.

• B. Incorrect.

  Incorrect. Re-signing an iOS app changes the code signature so it can be installed in a testing context, but it does not inherently disable jailbreak detection logic implemented by the app. If the detection code checks file paths, sandbox behavior, loaded libraries, or URL schemes, those checks will still execute unless the code is patched or bypassed. This option reflects a common misconception between app deployment/signing issues and runtime protection logic.

• C. Incorrect.

  Incorrect. iCloud Backup status is not a standard mechanism used by iOS applications to determine whether a device is jailbroken. Jailbreak detection typically relies on local indicators such as filesystem artifacts, suspicious apps, writable restricted paths, dynamic libraries, fork behavior, or debugger/instrumentation detection. Changing backup settings would not be an appropriate or reliable bypass technique.

• D. Incorrect.

  Incorrect. Airplane Mode does not generally affect local jailbreak detection routines. Most jailbreak checks are performed entirely on-device and do not require network connectivity. While some apps may have separate remote attestation or server-side risk checks, the scenario specifically describes an app that stops working on jailbroken devices, which is commonly enforced by local detection logic. This option confuses network-dependent security controls with local anti-tampering and jailbreak checks.

Correct answer: A

• A. Correct.

  Correct. This is the most effective first step because it uses core MDM capabilities to enforce baseline security controls consistently before allowing access to corporate resources. Compliance checks can identify rooted or jailbroken devices, verify encryption and screen-lock requirements, and deny or quarantine noncompliant devices. Selective wipe is especially appropriate in BYOD environments because it removes corporate data without necessarily erasing personal data. This directly addresses the scenario's problems: unmanaged access, weak device posture, and risk from lost devices.

• B. Incorrect.

  Incorrect. Security awareness and acceptable use policies are helpful administrative controls, but they do not technically enforce encryption, screen lock, root/jailbreak detection, or remote removal of corporate data. In this scenario, the company already has real device-level risk, so policy alone is insufficient.

• C. Incorrect.

  Incorrect. Protecting laptops does not solve the primary issue, which is insecure mobile devices directly accessing corporate email and applications. Even if laptop antivirus is useful elsewhere, it does not enforce mobile compliance, detect rooted phones, or wipe data from a lost smartphone. This option reflects a scope mismatch.

• D. Incorrect.

  Incorrect. Disabling Wi-Fi does not address the central MDM problems in the scenario. Devices could still be lost, rooted, unencrypted, or retain active corporate profiles over cellular connections. Also, many corporate mobile threats are related to device posture and data governance rather than whether traffic uses Wi-Fi or cellular.

Correct answer: A

• A. Correct.

  Correct. In a BYOD environment, MDM containerization separates corporate data and applications from personal data, allowing enforcement of security policies such as encryption, copy/paste restrictions, and managed app access. Selective wipe is specifically designed to remove only enterprise-managed data, certificates, and profiles when a device is lost, compromised, jailbroken, or when the user leaves the company. This directly addresses the scenario’s requirement to reduce data exposure without deleting personal content.

• B. Incorrect.

  Incorrect. Full-device wipe can protect data, but it is usually too invasive for BYOD because it erases the employee’s personal data as well. The scenario explicitly states management wants to avoid wiping personal photos, apps, and messages. Full wipe is more appropriate for fully corporate-owned devices under stricter ownership and consent models.

• C. Incorrect.

  Incorrect. User-managed antivirus and manual deletion do not provide centralized policy enforcement, compliance monitoring, or reliable incident response. They also do not address jailbroken devices or ensure enterprise data is removed when a device is lost or an employee separates from the company. This reflects a common misconception that endpoint security apps alone can replace MDM controls.

• D. Incorrect.

  Incorrect. Disabling passcodes weakens device security and increases the likelihood of unauthorized access if the device is lost or stolen. While VPNs help protect data in transit, they do not isolate corporate data on the device or support selective removal of enterprise content. This option contradicts basic mobile security best practices.

Correct answer: A

• A. Correct.

  Correct. A core MDM use case is enforcing device compliance before granting access to corporate resources. In a BYOD environment, policies that detect root/jailbreak status, check OS version, and gate access through conditional access or compliance enforcement are the most practical and scalable first step. This directly addresses the discovered risks: rooted devices, insecure developer settings, and outdated operating systems. Many MDM/UEM platforms can also flag risky configurations such as USB debugging and mark devices noncompliant.

• B. Incorrect.

  Incorrect. In a BYOD program, silently removing all personal apps is generally not an appropriate or realistic first response and may exceed the organization's privacy boundaries depending on the enrollment model. MDM is typically used to manage corporate data and enforce compliance, not to indiscriminately remove personal software from employee-owned devices. The misconception is assuming full administrative control is acceptable in all BYOD deployments.

• C. Incorrect.

  Incorrect. Disabling Wi-Fi does not address the root causes identified in the assessment. A rooted device or one running an outdated OS remains risky whether it uses Wi-Fi or cellular data. This option may also disrupt legitimate business use and is not a standard MDM best practice for mitigating device integrity and patch-level issues.

• D. Incorrect.

  Incorrect. Manual self-reporting is weak, error-prone, and easy to bypass. One of the main advantages of MDM is centralized, automated compliance monitoring and enforcement. Relying on users to disclose root status or patch levels does not provide trustworthy enforcement and would not scale well in an enterprise environment.

Correct answer: C

• A. Incorrect.

  This is not the best answer because the scenario explicitly says the client does not want the consultant to modify the APK or rely on static code review alone. MobSF is a legitimate mobile application security testing framework and is very useful for static and dynamic analysis, but the option emphasizes decompilation and source review rather than validating runtime protections and actual behavior in transit and at rest.

• B. Incorrect.

  This is not the best answer because adb backup is not a reliable or broadly applicable method for modern Android assessments. Many apps disable backup, and newer Android versions have significantly restricted or deprecated this capability. It also focuses mainly on data-at-rest artifacts and does not address transport security controls such as TLS validation or certificate pinning. A tester choosing this may be assuming older Android backup behavior still applies universally.

• C. Correct.

  This is the best answer. It aligns with the client's requirement to assess data protection in transit and at rest without modifying the APK and without relying only on static analysis. Burp Suite can help validate transport-layer protections, TLS behavior, and whether sensitive data is exposed over the network. Frida and Objection are commonly used for dynamic mobile assessment to inspect runtime behavior, test for certificate pinning, observe how secrets are handled in memory, and evaluate whether the app stores sensitive data insecurely on the device. This approach matches practical mobile testing guidance and real-world CEH-style assessment methodology.

• D. Incorrect.

  This is incorrect because rooting a device may be useful in some lab scenarios, but disabling Android sandboxing is not a normal or appropriate assessment approach and does not reflect mobile security best practices. It also changes the execution environment significantly, which can reduce the reliability of findings about how the app behaves on a standard device. A tester might select this because root access can increase visibility, but it is overly invasive and not the best fit for the stated constraints.