Mobile Device Threats and Security Controls NDE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An organization wants to reduce the risk of malicious mobile apps. The security team is evaluating app vetting practices. Which approach is most effective?

   • AAllow only apps from the official app store and require user training on phishing.
   • BRequire users to read app permissions before installing.
   • CUse an MDM solution that restricts app installation to a pre-approved app catalog.
   • DInstall a mobile antivirus on each device.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A financial services company has a mobile workforce that uses both iOS and Android devices. The security team has detected an increase in phishing attempts via SMS and malicious apps sideloaded from unofficial sources. The company wants to reduce these threats without degrading user productivity. Which combination of controls is most effective?

   • AImplement an MDM that restricts app installation to approved app stores and deploy a mobile threat defense (MTD) solution that detects phishing and malicious apps.
   • BDisable SMS on all corporate devices and use only secure messaging apps.
   • CRequire users to change their passwords every 30 days and use a VPN.
   • DProvide user training on phishing and require users to manually verify app sources.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A software company is developing a mobile app that handles sensitive user data. The app will be distributed through the official app store. The company wants to minimize the risk of data leakage from the app. Which combination of practices should the development team follow?

   • ARequest all permissions at install time to simplify user experience.
   • BImplement least-privilege permissions, use certificate pinning, and encrypt data at rest.
   • CStore data in the app sandbox without additional encryption.
   • DUse a VPN within the app and disable logging.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company's mobile devices are being targeted by a sophisticated attack that uses a malicious Wi-Fi access point to intercept traffic and redirect users to fake login pages. The company has already deployed a VPN, but the attack still succeeds because users are tricked into installing a certificate. What additional control should be implemented?

   • ARequire users to manually verify the Wi-Fi network name before connecting.
   • BIncrease the VPN encryption strength.
   • CDeploy a mobile threat defense (MTD) solution that can detect rogue access points and certificate anomalies.
   • DDisable Wi-Fi on all mobile devices and use only cellular data.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company's mobile users report that their devices are receiving unsolicited SMS messages with links to a fake banking website. The messages appear to come from the company's bank. Several users have entered their credentials on the fake site. Which type of mobile threat is this, and what control should the company implement to reduce the risk?

   • AA malware infection; perform a full device wipe on all affected devices
   • BSMS phishing (smishing); implement user awareness training and encourage the use of a mobile security app that filters SMS messages
   • CA man-in-the-middle attack; require the use of a VPN on all mobile devices
   • DA denial-of-service attack; disable SMS on all corporate devices
   Reveal Solution Discussion Select an answer first