Examkin

Question

Difficulty: MediumTroubleshooting Mobile OS Security and Connectivity Issues

A mobile user reports that their corporate smartphone is experiencing severe battery drain, sending unauthorized SMS messages, and displaying certificate warning pop-ups. A technician determines that an untrusted configuration profile was installed via a phishing link.

Place the following incident response and remediation steps in the correct chronological order to mitigate the threat and securely restore the device.

  1. 1Disconnect the device from all cellular and Wi-Fi networks.
  2. 2Remove the malicious configuration profile and unapproved application from the mobile OS settings.
  3. 3Perform a complete system antimalware scan and verify operating system integrity.
  4. 4Re-enroll the smartphone into the Enterprise Mobile Device Management (MDM) platform.

Answer

The proper sequence to remediate the compromised mobile device is: 1) Disconnect the device from all cellular and Wi-Fi networks, 2) Remove the malicious configuration profile and unapproved application from the mobile OS settings, 3) Perform a complete system antimalware scan and verify operating system integrity, and 4) Re-enroll the smartphone into the Enterprise Mobile Device Management (MDM) platform.
When troubleshooting mobile security incidents, containment must occur before remediation. First, isolating the device from Wi-Fi and cellular networks stops remote attack vectors and exfiltration. Next, removing the rogue profile and malicious application clears unauthorized settings and administrative rights. Then, scanning the device verifies eradication of hidden malicious components. Finally, re-enrolling the clean device into the Enterprise MDM reinstates trusted security profiles and access rights.

Step-by-Step Solution

1
Isolate the compromised mobile device by placing it in Airplane mode or turning off Wi-Fi and cellular radios.
Network isolation stops outgoing malicious traffic, SMS exfiltration, and remote attacker commands.
Containment is always the first step in mobile security incident response.
2
Navigate to the OS management settings to uninstall the rogue profile and application.
The persistent unauthorized configurations and elevated permissions are removed from the system.
Eliminates the root cause of unauthorized system configuration changes.
3
Run full antimalware scanning and perform operating system file verification.
Verifies that the file system is clean and no hidden background processes remain.
Ensures complete eradication of malware before rejoining corporate systems.
4
Re-connect to secure provisioning and register the device with corporate MDM.
Corporate compliance policies, valid internal certificates, and access control settings are fully restored.
Re-establishes a trusted operational security baseline for company network access.

Key Concept

Mobile Device Security Incident Response Workflow
Rate this question

Topics

Troubleshooting Mobile OS Security and Connectivity Issues

More questions from this topic