A security administrator discovers that a corporate mobile device was connected to an unau… — CompTIA A+ (Core 1 & Core 2)

A security administrator discovers that a corporate mobile device was connected to an unauthorized rogue Wi-Fi access point and subsequently installed a malicious configuration profile. Place the following remediation steps in the correct chronological order to contain the incident and restore the device to a secure state.

1Disconnect and isolate the mobile device from all cellular and enterprise wireless networks.
2Remove the unauthorized configuration profile and untrusted root certificates from the device settings.
3Reset compromised user credentials and run a full security scan to verify OS integrity.
4Re-enroll the mobile device into the enterprise Mobile Device Management (MDM) portal to enforce compliant security policies.

Answer

The correct sequence begins with network isolation of the compromised mobile device, followed by removing the malicious configuration profile and root certificates, revoking and updating compromised account credentials while scanning for malware, and finally re-enrolling the device into enterprise Mobile Device Management (MDM).

In CompTIA security troubleshooting procedures, containment (disconnecting network interfaces) must take place before remediation (deleting rogue profiles/certificates and resetting passwords). Once the device is remediated and verified clean, recovery (MDM re-enrollment and policy deployment) restores secure operational status.

Step-by-Step Solution

Isolate the compromised mobile device from all active networks.

Prevents active data exfiltration, rogue server traffic, and lateral movement.

Containment is always the top priority when responding to unauthorized mobile access or rogue network connections.

Delete the unauthorized profile and malicious CA certificates.

Stops the rogue profile from managing device settings or decrypting traffic via untrusted certificates.

Eliminates the persistent vector created during the security incident.

Reset user authentication tokens/passwords and scan the OS.

Ensures compromise of credentials during the MITM or rogue AP session cannot be leveraged elsewhere.

Remediates potential secondary compromise of account credentials and confirms no residual malicious payload remains.

Re-enroll the device into enterprise MDM.

Restores legitimate corporate access and re-applies enterprise compliance baselines.

Brings the device back into compliance under centralized administrative control.

Key Concept

Mobile Device Incident Response and Security Remediation Workflow

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic