Examkin

Question

Difficulty: HardMobile Device and Embedded System Security

An enterprise administrator is deploying security policies for a fleet of mobile devices used by field technicians accessing sensitive customer data. The organization requires that all corporate emails, internal documents, and proprietary tools operate within an encrypted, isolated workspace that prevents copy-paste capabilities into personal applications. Furthermore, IT must be able to perform a targeted removal of only enterprise data when an employee leaves the company, without affecting personal photos or personal applications. Which of the following controls should the administrator implement to satisfy these requirements?

  1. Containerization combined with Mobile Application Management (MAM) policiesAnswer
  2. B
    Full-device encryption (FDE) paired with automated remote device bricking
  3. C
    Geofencing policies managed through a Wireless Intrusion Prevention System (WIPS)
  4. D
    Sideloading restrictions coupled with WPA3-Enterprise pre-shared key authentication

Answer

Containerization combined with Mobile Application Management (MAM) policies is the correct control.
Containerization creates a secure, encrypted sandbox on the mobile device that isolates corporate applications and data from personal applications. Combined with Mobile Application Management (MAM), administrators can enforce Data Loss Prevention (DLP) rules such as restricting copy-paste actions between enterprise and personal apps, and perform a selective wipe to remove only corporate credentials and data when an employee leaves.

Step-by-Step Solution

1
Analyze the technical requirements in the scenario.
Identified key requirements: isolated/encrypted workspace, prevention of copy-paste between corporate and personal apps, and selective wiping of business data only.
Understanding the precise operational constraints is essential for selecting the appropriate Mobile Device Management security control.
2
Evaluate technologies that enforce data isolation and selective data destruction.
Containerization creates a sandboxed storage boundary separating enterprise apps from personal apps, enforcing clipboard isolation. Mobile Application Management (MAM) enables selective remote wipe capabilities.
Containerization and MAM directly fulfill both data separation and targeted wipe requirements.
3
Eliminate options that misapply full-device controls or network/physical security features.
Full-device encryption and full remote wiping destroy all device data rather than performing a selective wipe. Geofencing and wireless authentication address location boundaries and network security rather than app-level sandboxing.
Alternative choices fail to address the application sandboxing and selective wipe constraints.

Key Concept

Mobile Containerization and MAM (Selective Wipe)
Rate this question

Topics

Mobile Device and Embedded System Security

More questions from this topic