A company's MDM reports that a user's Android device is 'compliant' even though the user has rooted the phone. The security team suspects the device agent is being bypassed. Which combination of factors most likely explains this false compliance status?

The device's VPN profile is not enforced, so the agent cannot communicate with the server

The device is enrolled using a user certificate instead of a device certificate

The MDM server is configured to allow rooted devices for this user group

The root cloaking app hides the root status from the MDM agent, and the agent's integrity check is disabled

Which technique might an attacker use to bypass MDM controls on a managed device?

Using a VPN to hide network traffic

Changing the device's wallpaper

Disabling the MDM agent by exploiting a vulnerability in the OS

A company uses MDM to manage corporate-owned devices, but it also wants to secure corporate data in third-party apps like Microsoft Outlook and Salesforce on employee-owned devices that are not enrolled in MDM. Which solution should be added?

Use a containerization app that wraps the entire device

Deploy Mobile Application Management (MAM) policies to those apps

Enroll the employee-owned devices in MDM

Use a VPN to secure all traffic on the device

During a penetration test, you discover that an employee's MDM-managed laptop is not actually receiving policy updates. The device shows as 'enrolled' in the MDM console, but the last check-in was 30 days ago. Which of the following is the most likely cause and the best next step?

The MDM server's policy is misconfigured to not push updates; correct the policy

The device is outside the corporate network and cannot reach the MDM server; connect to VPN

The user has disabled the MDM agent in Task Manager; restart the agent service

The device's certificate has expired, so the MDM agent cannot authenticate; re-enroll the device

During a security assessment, you find that an MDM solution is not enforcing a minimum Android OS version. Devices running outdated OS versions are still able to access corporate email. Which of the following is the best recommendation to address this vulnerability?

Use a VPN to secure the connection

Recommend users manually update their devices

Configure a compliance policy that requires a minimum OS version and blocks access for non-compliant devices

Increase the frequency of MDM check-ins

EC-CouncilCertified Ethical Hacker

Domain 7Objective 3

Mobile Device Management CEH Practice Questions (Page 9)

Part of the Mobile, IoT and OT Hacking domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 2–4 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

7concepts

Questions 41–45

41expert · hard
A company's MDM reports that a user's Android device is 'compliant' even though the user has rooted the phone. The security team suspects the device agent is being bypassed. Which combination of factors most likely explains this false compliance status?
Select an answer first
42foundation · easy
Which technique might an attacker use to bypass MDM controls on a managed device?
Select an answer first
43application · medium
A company uses MDM to manage corporate-owned devices, but it also wants to secure corporate data in third-party apps like Microsoft Outlook and Salesforce on employee-owned devices that are not enrolled in MDM. Which solution should be added?
Select an answer first
44expert · hard
During a penetration test, you discover that an employee's MDM-managed laptop is not actually receiving policy updates. The device shows as 'enrolled' in the MDM console, but the last check-in was 30 days ago. Which of the following is the most likely cause and the best next step?
Select an answer first
45expert · hard
During a security assessment, you find that an MDM solution is not enforcing a minimum Android OS version. Devices running outdated OS versions are still able to access corporate email. Which of the following is the best recommendation to address this vulnerability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.