Mobile Device Security CCT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A financial firm requires that employees authenticate to their corporate mobile devices using a method that is resistant to shoulder surfing and cannot be easily replicated. The firm also wants to enforce a policy that locks the device after a short period of inactivity. Which authentication method and policy combination best meets these requirements?

   • AUse a password manager to autofill a complex password each time the device is unlocked.
   • BUse a simple 4-digit PIN and set the device to lock after 30 minutes.
   • CUse a pattern lock and disable the auto-lock feature to avoid user frustration.
   • DUse biometric authentication (fingerprint or face) and configure an automatic lock after 2 minutes of inactivity.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's employees use mobile devices to access internal resources from remote locations. The security team wants to ensure that all traffic is encrypted and that devices are not connecting to malicious networks. Which combination of controls should they implement?

   • AUse a firewall app to block malicious traffic.
   • BRequire a VPN and use a mobile threat defense solution to detect rogue access points.
   • CUse only HTTPS for all internal resources.
   • DDisable Wi-Fi and require cellular data only.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A government agency requires that mobile devices used by field agents authenticate with a smart card and a PIN. The agency also needs to ensure that if a device is lost, the data cannot be accessed. The devices are enrolled in MDM. Which authentication and access control approach best meets the agency's requirements?

   • AUse biometric authentication instead of a smart card because it is faster for field agents.
   • BUse a simple PIN for device unlock and rely on the smart card only for accessing classified documents.
   • CUse smart card authentication for device unlock and configure MDM to enforce a remote wipe after a failed authentication threshold.
   • DDisable the device lock and require agents to log in to a secure portal with their smart card.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A regional hospital allows clinicians to use personal smartphones to access patient records through a secure portal. The compliance team requires that any device with access to patient data must enforce a screen lock, encrypt local storage, and allow remote wipe if lost. Which solution should the IT team implement to enforce these requirements across both personally owned and hospital-issued devices?

   • AUse a VPN client on each device to secure the connection and assume that the portal's encryption protects all data.
   • BAsk users to manually enable the screen lock and encryption in their device settings and provide a written policy for remote wipe.
   • CDeploy a mobile application management (MAM) policy that only protects the patient portal app, leaving the rest of the device unmanaged.
   • DConfigure a mobile device management (MDM) policy that requires a passcode, enables device encryption, and supports remote wipe on enrolled devices.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company wants to enforce strong authentication on employee smartphones that access corporate resources. They want to avoid passwords that can be shoulder-surfed and want to ensure that only authorized devices can connect. Which approach should they choose?

   • AUse SMS-based one-time passcodes for authentication.
   • BImplement certificate-based authentication with a device certificate issued by the company's PKI.
   • CRequire users to enter a complex password every time they access corporate resources.
   • DRely on the device's biometric unlock as the sole authentication method.
   Reveal Solution Discussion Select an answer first