How should an organization's mobile device management (MDM) policy address rooted or unlocked devices?

By ignoring the rooting status because it does not affect the device's ability to connect to the corporate network.

By allowing them as long as the user signs a waiver accepting all risks.

By detecting rooted or unlocked devices and either blocking access to corporate data or requiring remediation.

By automatically granting them full access to corporate resources because the user has administrative control.

What is a recommended action for an organization when a rooted device is detected on its network?

Ask the user to uninstall the rooting app and continue using the device.

Send the user a warning email but allow continued access.

Perform a remote wipe of the device to remove all corporate data.

Ignore the issue because rooting is a user's personal choice.

Which tool or method can an MDM solution use to detect a rooted device?

Checking for the existence of the 'su' binary in the device's system partition.

Measuring the device's CPU temperature to detect unusual activity.

Checking the device's screen resolution to see if it has been modified.

Reading the device's IMEI number and comparing it to a list of known rooted devices.

A company allows employees to use their own Android devices for work. The security team wants to mitigate the risk of rooted devices accessing corporate data. Which combination of measures is most effective?

Require all employees to use a VPN on their personal devices.

Block all personal devices from accessing corporate resources.

Provide employees with a list of root-checker apps to run manually.

Use an MDM that detects root status and enforces conditional access to corporate apps, and containerize corporate data in a separate work profile.

A security analyst is reviewing a fleet of Android devices enrolled in an MDM. One user reports that their device is running a custom ROM and that the MDM agent no longer reports compliance status. The analyst needs to confirm whether the device is rooted before deciding on a response. Which approach provides the most reliable evidence of root status?

Review the device's IMEI and compare it against the carrier's unlock database.

Ask the user to run a root-checker app and report the result.

Check the MDM console for a compliance policy violation indicating a failed SafetyNet attestation.

Remotely execute a shell command on the device to check for the presence of the 'su' binary.

GIAC Mobile Device Security Analyst

Domain 1Objective 4

Unlocking and Rooting Mobile Devices GMOB Practice Questions (Page 3)

Part of the Mobile Device Management and Security domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–28 in this domain), expect 5–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 11–15

11foundation · easy
How should an organization's mobile device management (MDM) policy address rooted or unlocked devices?
Select an answer first
12foundation · easy
What is a recommended action for an organization when a rooted device is detected on its network?
Select an answer first
13foundation · easy
Which tool or method can an MDM solution use to detect a rooted device?
Select an answer first
14application · medium
A company allows employees to use their own Android devices for work. The security team wants to mitigate the risk of rooted devices accessing corporate data. Which combination of measures is most effective?
Select an answer first
15application · medium
A security analyst is reviewing a fleet of Android devices enrolled in an MDM. One user reports that their device is running a custom ROM and that the MDM agent no longer reports compliance status. The analyst needs to confirm whether the device is rooted before deciding on a response. Which approach provides the most reliable evidence of root status?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.