312-50 Question 404
Single answer▪ Mobile Device ManagementA company allows employees to use personal smartphones to access corporate email and internal collaboration apps. During a security assessment, you discover that several Android devices enrolled in the company's Mobile Device Management (MDM) platform are rooted, one device has USB debugging enabled, and another is running an outdated OS version with known vulnerabilities. The security team wants to reduce the risk of data leakage while still supporting BYOD. Which MDM control would be the MOST effective first step to address this situation across the enrolled devices?
- A
Configure compliance policies to detect rooted devices, block noncompliant devices from corporate resources, and require minimum OS versions
- B
Use MDM to silently uninstall all personal applications from enrolled BYOD devices
- C
Disable all Wi-Fi connectivity on enrolled mobile devices so users can only access data over cellular networks
- D
Require users to manually report whether their devices are rooted or out of date before allowing email access
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use MDM compliance policies to automatically assess device posture and restrict access when devices fail security requirements. In real-world CEH scenarios, the focus is on practical controls that reduce attack surface and data exposure without relying on user honesty or disruptive blanket restrictions. For BYOD, this usually means enforcing minimum OS versions, detecting rooted or jailbroken devices, identifying risky settings where supported, and using conditional access to block or limit access to corporate email and apps until remediation occurs. This approach aligns with common enterprise mobility and zero trust practices and is consistent with guidance from major platform vendors and MDM/UEM providers, which emphasize device compliance, patch currency, and device integrity as prerequisites for corporate access.
- A. Correct.
Correct. A core MDM use case is enforcing device compliance before granting access to corporate resources. In a BYOD environment, policies that detect root/jailbreak status, check OS version, and gate access through conditional access or compliance enforcement are the most practical and scalable first step. This directly addresses the discovered risks: rooted devices, insecure developer settings, and outdated operating systems. Many MDM/UEM platforms can also flag risky configurations such as USB debugging and mark devices noncompliant.
- B. Incorrect.
Incorrect. In a BYOD program, silently removing all personal apps is generally not an appropriate or realistic first response and may exceed the organization's privacy boundaries depending on the enrollment model. MDM is typically used to manage corporate data and enforce compliance, not to indiscriminately remove personal software from employee-owned devices. The misconception is assuming full administrative control is acceptable in all BYOD deployments.
- C. Incorrect.
Incorrect. Disabling Wi-Fi does not address the root causes identified in the assessment. A rooted device or one running an outdated OS remains risky whether it uses Wi-Fi or cellular data. This option may also disrupt legitimate business use and is not a standard MDM best practice for mitigating device integrity and patch-level issues.
- D. Incorrect.
Incorrect. Manual self-reporting is weak, error-prone, and easy to bypass. One of the main advantages of MDM is centralized, automated compliance monitoring and enforcement. Relying on users to disclose root status or patch levels does not provide trustworthy enforcement and would not scale well in an enterprise environment.