Mobile Device Security CCT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A multinational corporation must comply with data residency laws that require customer data to remain within specific geographic regions. Employees use mobile devices to access customer data. The compliance team wants to enforce that data is not stored on devices outside the approved region. Which combination of controls is most effective?

   • AUse MDM to enforce a policy that blocks data storage on the device and requires access through a virtual desktop or cloud portal hosted in the approved region.
   • BRequire employees to use only company-issued devices that are physically located in the approved region.
   • CUse a VPN that routes traffic through a data center in the approved region, but allow local storage on the device.
   • DEncrypt all data on the device and rely on the encryption to satisfy data residency requirements.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security analyst is investigating a suspected data breach from a corporate iPhone. The device is passcode-protected and has full-disk encryption enabled. The analyst needs to extract forensic evidence without altering the device. Which approach is most appropriate?

   • AAsk the user to provide the passcode and then manually review the device's apps and messages.
   • BPerform a factory reset to ensure the device is clean before analyzing it.
   • CConnect the device to a computer and browse the file system directly to look for suspicious files.
   • DCreate a forensic image of the device using a tool that supports encrypted iOS backups, and analyze the image in a controlled environment.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company wants to allow employees to use their personal phones for work, but only if the device meets security standards. They want to avoid forcing employees to use a complex password every time they unlock the phone. Which approach balances security and usability?

   • AUse a certificate-based authentication for device unlock.
   • BEnroll the device in MDM and require a biometric unlock with a fallback PIN.
   • CRequire a 12-character alphanumeric password for device unlock.
   • DAllow any lock screen method, including swipe, as long as the device is enrolled.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A startup is developing a mobile banking app. The security team wants to minimize the risk of credential theft and unauthorized transactions. They are considering: (1) implementing certificate pinning, (2) using biometric authentication, (3) storing tokens in secure hardware, and (4) requesting location permission at install. Which combination of practices is most effective for the app's security?

   • AUse biometric authentication and request location permission at install to verify user identity.
   • BStore tokens in shared preferences and rely on HTTPS for all communications.
   • CImplement certificate pinning, use biometric authentication, and store session tokens in the device's secure enclave.
   • DImplement certificate pinning and request all permissions at install to simplify the user experience.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An employee reports that their company-issued phone was lost. The phone contained sensitive client data. The security team needs to preserve evidence for potential forensic analysis while also protecting the data. What should they do first?

   • APlace the device in lost mode and remotely lock it, then initiate a forensic acquisition if the device is recovered.
   • BAsk the employee to change their passwords and wait to see if the device is returned.
   • CContact the carrier to disable the SIM card and block the device.
   • DImmediately perform a remote wipe to ensure data is destroyed.
   Reveal Solution Discussion Select an answer first