Examkin

Soru

Zorluk: ZorTroubleshooting Mobile OS Security and Connectivity Issues

A security administrator discovers that a corporate mobile device was connected to an unauthorized rogue Wi-Fi access point and subsequently installed a malicious configuration profile. Place the following remediation steps in the correct chronological order to contain the incident and restore the device to a secure state.

  1. 1Disconnect and isolate the mobile device from all cellular and enterprise wireless networks.
  2. 2Remove the unauthorized configuration profile and untrusted root certificates from the device settings.
  3. 3Reset compromised user credentials and run a full security scan to verify OS integrity.
  4. 4Re-enroll the mobile device into the enterprise Mobile Device Management (MDM) portal to enforce compliant security policies.

Cevap

The correct sequence begins with network isolation of the compromised mobile device, followed by removing the malicious configuration profile and root certificates, revoking and updating compromised account credentials while scanning for malware, and finally re-enrolling the device into enterprise Mobile Device Management (MDM).
In CompTIA security troubleshooting procedures, containment (disconnecting network interfaces) must take place before remediation (deleting rogue profiles/certificates and resetting passwords). Once the device is remediated and verified clean, recovery (MDM re-enrollment and policy deployment) restores secure operational status.

Adım Adım Çözüm

1
Isolate the compromised mobile device from all active networks.
Prevents active data exfiltration, rogue server traffic, and lateral movement.
Containment is always the top priority when responding to unauthorized mobile access or rogue network connections.
2
Delete the unauthorized profile and malicious CA certificates.
Stops the rogue profile from managing device settings or decrypting traffic via untrusted certificates.
Eliminates the persistent vector created during the security incident.
3
Reset user authentication tokens/passwords and scan the OS.
Ensures compromise of credentials during the MITM or rogue AP session cannot be leveraged elsewhere.
Remediates potential secondary compromise of account credentials and confirms no residual malicious payload remains.
4
Re-enroll the device into enterprise MDM.
Restores legitimate corporate access and re-applies enterprise compliance baselines.
Brings the device back into compliance under centralized administrative control.

Anahtar Kavram

Mobile Device Incident Response and Security Remediation Workflow
Bu soruyu puanla

Konular

Troubleshooting Mobile OS Security and Connectivity Issues

Bu konudan daha fazla soru