An enterprise MDM administrator discovers that a user's device is infected with malware that exfiltrates contacts. The malware is not using a known C2 domain but is communicating over HTTPS to a dynamic DNS service. Which immediate MDM action best limits further data loss while preserving forensic evidence?

Uninstall the suspicious app remotely.

Disable the device's network access via MDM and then initiate a forensic acquisition.

Push a new certificate to the device to decrypt HTTPS traffic.

Remotely wipe the device immediately.

When a mobile malware infection is detected on an MDM-managed device, what is a common MDM-based response action?

Updating the device's wallpaper to a warning message

Sending the user a text message with removal instructions

Increasing the device's screen brightness to improve visibility

Remotely wiping the device to remove the malware and protect data

An organization's MDM allows users to enroll their personal devices (BYOD). The security team wants to prevent malware from accessing corporate data if a user's device is compromised. Which MDM policy is most effective?

Monitor all network traffic from the device to detect malware communication.

Disable all personal app installations on BYOD devices.

Containerize corporate apps and data in a separate managed profile.

Require users to install a third-party antivirus app on their personal devices.

Which MDM capability is most directly used to prevent mobile malware infections?

Enforcing a policy that only allows installation of approved apps from managed app catalogs

Displaying the device's battery status to the user

Providing users with a helpdesk number for reporting issues

Allowing users to choose their own device passcode

A company is deploying a BYOD program. They want to allow employees to use personal apps on their devices but prevent those apps from accessing corporate data. Which approach provides the strongest isolation?

Use a VPN to encrypt all traffic from the device.

Require employees to use a third-party container app for corporate email and documents.

Ask employees to sign a policy stating they will not install personal apps on the device.

Use an MDM to create a separate work profile that contains corporate apps and data.

GIAC Mobile Device Security Analyst

Domain 4Objective 2

Mitigating Against Mobile Malware GMOB Practice Questions (Page 6)

Part of the Mobile Malware and Application Behavior domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

7concepts

Questions 26–30

26application · medium
An enterprise MDM administrator discovers that a user's device is infected with malware that exfiltrates contacts. The malware is not using a known C2 domain but is communicating over HTTPS to a dynamic DNS service. Which immediate MDM action best limits further data loss while preserving forensic evidence?
Select an answer first
27foundation · easy
When a mobile malware infection is detected on an MDM-managed device, what is a common MDM-based response action?
Select an answer first
28application · medium
An organization's MDM allows users to enroll their personal devices (BYOD). The security team wants to prevent malware from accessing corporate data if a user's device is compromised. Which MDM policy is most effective?
Select an answer first
29foundation · easy
Which MDM capability is most directly used to prevent mobile malware infections?
Select an answer first
30expert · hard
A company is deploying a BYOD program. They want to allow employees to use personal apps on their devices but prevent those apps from accessing corporate data. Which approach provides the strongest isolation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.