What is the first step in an incident response process for mobile malware?

Deleting the user's personal photos from the device

Detecting the infection through monitoring, alerts, or user reports

Remotely wiping all devices in the enterprise

Contacting the device manufacturer for a refund

A company has a high rate of mobile phishing incidents. They have implemented technical controls like email filtering and web filtering, but incidents continue. The security team wants to invest in user education. Which approach is most likely to reduce incidents?

Implement a continuous training program with simulated phishing campaigns and micro-learning modules.

Conduct a one-time security awareness training session for all employees.

Post monthly newsletters with tips on how to spot phishing emails.

Require employees to pass a phishing quiz every year.

A hospital allows staff to use personal devices to access patient records through a web portal. The security team is concerned about malware that could intercept credentials on public Wi-Fi. Which network-level control best mitigates this risk while supporting a bring-your-own-device (BYOD) model?

Block access to the portal from any network other than the corporate LAN.

Use a web filter that blocks known malicious domains.

Require users to disable Wi-Fi and use cellular data only.

Require a VPN with split tunneling disabled for all devices accessing the portal.

A user reports that their company-issued smartphone is acting strangely: battery drains quickly, data usage spikes, and pop-ups appear. The device is enrolled in MDM. What is the first step in the incident response process?

Ask the user to continue using the device to monitor the symptoms.

Immediately factory reset the device to remove any malware.

Disconnect the device from the network and collect a forensic image.

Uninstall all third-party apps from the device.

A security analyst is reviewing a mobile app that requests permission to read SMS messages. The app is a legitimate-looking flashlight app from an official store. The analyst wants to minimize the risk of data theft. What is the best course of action?

Use an MDM to block the app from accessing the network.

Deny the SMS permission and use the app without it.

Grant the permission because the app is from the official store.

GIAC Mobile Device Security Analyst

Domain 4Objective 2

Mitigating Against Mobile Malware GMOB Practice Questions (Page 5)

Part of the Mobile Malware and Application Behavior domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

7concepts

Questions 21–25

21foundation · easy
What is the first step in an incident response process for mobile malware?
Select an answer first
22expert · hard
A company has a high rate of mobile phishing incidents. They have implemented technical controls like email filtering and web filtering, but incidents continue. The security team wants to invest in user education. Which approach is most likely to reduce incidents?
Select an answer first
23application · medium
A hospital allows staff to use personal devices to access patient records through a web portal. The security team is concerned about malware that could intercept credentials on public Wi-Fi. Which network-level control best mitigates this risk while supporting a bring-your-own-device (BYOD) model?
Select an answer first
24application · medium
A user reports that their company-issued smartphone is acting strangely: battery drains quickly, data usage spikes, and pop-ups appear. The device is enrolled in MDM. What is the first step in the incident response process?
Select an answer first
25application · medium
A security analyst is reviewing a mobile app that requests permission to read SMS messages. The app is a legitimate-looking flashlight app from an official store. The analyst wants to minimize the risk of data theft. What is the best course of action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.