Examkin

Question

Difficulty: MediumTroubleshooting Mobile OS Security and Connectivity Issues

A mobile security technician receives an automated alert indicating that an enterprise-managed smartphone is transmitting unauthorized data over an unencrypted channel after a user installed an untrusted profile. In what sequence should the technician perform the remediation steps to secure the device and restore access?

  1. 1Isolate the mobile device by enabling Airplane Mode and disabling Wi-Fi and cellular data radios.
  2. 2Remove the unauthorized configuration profile and associated third-party application from the OS settings.
  3. 3Execute a full system scan using an enterprise-approved mobile anti-malware tool.
  4. 4Re-enroll the mobile device into the Mobile Device Management (MDM) portal.
  5. 5Disable Airplane Mode and verify secure connectivity to corporate network resources.

Answer

The correct incident response sequence is: 1) Isolate the mobile device by enabling Airplane Mode, 2) Remove the unauthorized configuration profile and application, 3) Execute a full system scan using mobile anti-malware, 4) Re-enroll the mobile device into the MDM portal, and 5) Disable Airplane Mode and verify secure connectivity.
Standard operational procedures for mobile security incident handling require containment (isolation via Airplane Mode) first. Once isolated, the root cause (untrusted profile/app) is removed, followed by anti-malware verification. The device must then be restored to corporate compliance via MDM re-enrollment before re-establishing network access and verifying functionality.

Step-by-Step Solution

1
Isolate the compromised mobile device from all networks immediately.
Network communication is terminated, stopping active exfiltration.
Containment is the primary objective in security incident handling to prevent further risk.
2
Uninstall the untrusted profile and associated application.
The unauthorized access mechanism is eliminated from the operating system.
Removing the rogue configuration prevents it from maintaining elevated privileges.
3
Perform a thorough antimalware inspection.
Any lingering secondary malware or spyware is identified and remediated.
Ensures the device is clean before re-introducing enterprise credentials or management baselines.
4
Re-enroll the device in MDM.
Compliant security policies, certificates, and app restrictions are pushed to the device.
Restores the enterprise trust state and security baseline required for network access.
5
Restore wireless network interfaces and validate corporate service access.
Normal secure operational status is confirmed.
Verification confirms that connectivity functions properly under secured conditions.

Key Concept

Mobile Incident Response and Unauthorized Access Remediation
Rate this question

Topics

Troubleshooting Mobile OS Security and Connectivity Issues

More questions from this topic