Examkin

Question

Difficulty: HardTroubleshooting Mobile OS Security and Connectivity Issues

A technician receives an alert that a corporate-managed mobile device has been infected with a malicious application exhibiting unauthorized remote access and data exfiltration behavior. Place the following mobile incident response and remediation actions in the correct sequential order.

  1. 1Enable Airplane mode to isolate the mobile device from all wireless and cellular networks.
  2. 2Revoke administrative rights for the suspicious application and uninstall it from the mobile operating system.
  3. 3Perform a full system scan using an enterprise-approved mobile security and anti-malware tool.
  4. 4Revoke active session tokens and reset corporate user account passwords from an uncompromised workstation.
  5. 5Disable Airplane mode, re-establish network connectivity, and install the latest OS security updates.

Answer

The correct order of steps to remediate the compromised mobile device is: 1) Enable Airplane mode to isolate the mobile device from all networks, 2) Revoke administrative rights for the suspicious application and uninstall it, 3) Perform a full system scan using an enterprise-approved mobile security tool, 4) Revoke active session tokens and reset account passwords from an uncompromised workstation, and 5) Disable Airplane mode, re-establish network connectivity, and install the latest OS security updates.
CompTIA standard mobile security incident response dictates that containment (isolating the device from Wi-Fi/cellular networks) must occur first to stop data exfiltration. Next, eradication occurs by revoking privileges and removing the malicious app, followed by a full security scan to ensure no hidden payloads remain. Account credentials are then secured from an outside workstation, and finally, the device is reconnected and patched.

Step-by-Step Solution

1
Isolate the mobile device from all network connections
Cellular, Wi-Fi, and Bluetooth channels are cut off, halting data exfiltration.
Containment is the essential first phase of incident response to prevent further compromise.
2
Uninstall the malicious application and revoke its permissions
The core threat vector and unauthorized device administrative access are removed.
Eradicating the malicious software prevents ongoing unauthorized changes to system settings.
3
Execute a full antimalware scan on the mobile OS
Residual malicious files or secondary Trojan payloads are detected and quarantined.
Scanning verifies that the device environment is clean before credentials or network access are restored.
4
Reset compromised user credentials from a clean system
Stolen credentials or hijacked OAuth session tokens are invalidated.
Changing passwords on a separate, uncompromised system ensures new credentials are not captured by remaining keyloggers.
5
Reconnect to the network and apply missing OS security patches
The mobile device is fully patched, verified compliant, and restored to service.
Updating the OS addresses underlying security flaws to prevent re-infection.

Key Concept

Mobile Device Security Incident Containment and Remediation Workflow
Rate this question

Topics

Troubleshooting Mobile OS Security and Connectivity Issues

More questions from this topic