A company has a BYOD policy that allows rooted devices, but the security team is concerned about data leakage. They want to implement a solution that protects corporate data without requiring the user to unroot. Which approach is the most effective?

Implement a remote wipe policy that wipes the device if root is detected.

Use a containerization solution that isolates corporate apps and data from the personal side.

Require the user to use a separate device for corporate work.

Use an MDM that supports app-level VPN and per-app data encryption.

A security analyst is evaluating root detection tools for an enterprise MDM. The analyst wants to minimize false positives while still detecting most rooted devices. Which detection strategy is most effective?

Use a single third-party root-checker app and trust its result.

Use a combination of checks, including the presence of the su binary, root-management apps, and bootloader status, and require multiple indicators to be present before flagging a device.

Rely solely on the presence of the su binary.

Rely solely on bootloader status.

GIAC Mobile Device Security Analyst

Domain 1Objective 4

Unlocking and Rooting Mobile Devices GMOB Practice Questions (Page 10)

Part of the Mobile Device Management and Security domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–28 in this domain), expect 5–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 46–47

46expert · hard
A company has a BYOD policy that allows rooted devices, but the security team is concerned about data leakage. They want to implement a solution that protects corporate data without requiring the user to unroot. Which approach is the most effective?
Select an answer first
47expert · hard
A security analyst is evaluating root detection tools for an enterprise MDM. The analyst wants to minimize false positives while still detecting most rooted devices. Which detection strategy is most effective?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.

Unlocking and Rooting Mobile Devices GMOB Practice Questions (Page 10)

Questions 46–47

A company has a BYOD policy that allows rooted devices, but the security team is concerned about data leakage. They want to implement a solution that protects corporate data without requiring the user to unroot. Which approach is the most effective?

A security analyst is evaluating root detection tools for an enterprise MDM. The analyst wants to minimize false positives while still detecting most rooted devices. Which detection strategy is most effective?

Keep studying — Mobile Device Management and Security