Examkin

Question

Difficulty: Very hardTroubleshooting Mobile OS Security and Connectivity Issues

A field technician's mobile tablet loses access to enterprise network resources after returning from a client site. Network logs show that HTTPS traffic from the device is being intercepted by an unauthorized proxy server, and the device's Mobile Device Management (MDM) agent reports a compliance violation. Further investigation reveals a third-party diagnostic utility was recently sideloaded on the device. Which TWO of the following initial actions should the systems administrator perform to remediate the security breach and restore secure connectivity?

  1. Remove the untrusted third-party root certificate installed in the device's credential storage.Answer
  2. Uninstall the sideloaded application and force an MDM compliance check to restore enterprise access tokens.Answer
  3. C
    Contact the mobile carrier to reset the device's Access Point Name (APN) configuration and issue a new SIM card.
  4. D
    Reconfigure the corporate wireless access points to fall back from WPA3-Enterprise to WPA2-Personal (PSK).
  5. E
    Grant elevated superuser/root permissions to the diagnostic utility to bypass MDM compliance rules.

Answer

The administrator should remove the untrusted root certificate from the device's credential storage and uninstall the sideloaded application, then initiate an MDM compliance check to restore enterprise access.
Sideloaded applications can install untrusted root CA certificates into mobile credential stores to intercept encrypted SSL/TLS communications. Removing the untrusted certificate stops the interception, while removing the unauthorized app and triggering an MDM compliance sync clears the security violation and restores corporate access tokens.

Step-by-Step Solution

1
Identify the vector of traffic interception and compliance failure.
Determined that a sideloaded diagnostic utility installed an untrusted root certificate, enabling MitM SSL interception and triggering an MDM policy violation.
Sideloaded apps frequently install custom CA certificates to inspect or redirect network traffic, violating enterprise security policy.
2
Remediate certificate store contamination and remove malicious software.
The untrusted root CA certificate is removed from the user credential store, and the sideloaded diagnostic tool is uninstalled.
Removing the root certificate breaks the MitM trust chain, and deleting the application prevents further policy violations.
3
Perform MDM posture re-evaluation.
The MDM agent verifies device health and re-issues corporate access tokens.
Once non-compliant applications and certificates are purged, forcing an MDM sync restores enterprise connectivity.

Key Concept

Mobile OS Security, Untrusted Certificate Remediation, and MDM Compliance Synchronization
Rate this question

Topics

Troubleshooting Mobile OS Security and Connectivity Issues

More questions from this topic