A company allows employees to use personal Android devices for email and calendar access. The security team wants to permit rooted devices as long as corporate data is protected. Which policy approach best balances user flexibility with data protection?

Require the user to unroot the device before enrolling in the MDM.

Block all rooted devices from accessing corporate email and calendar.

Allow rooted devices but require the user to sign a liability waiver.

Use an MDM that supports containerization and enforce a policy that corporate apps run in a separate, managed container.

An organization is updating its mobile device policy. They want to allow users to unlock the bootloader for development purposes but still protect corporate data. Which policy statement best achieves this goal?

Allow bootloader unlocking but require the user to re-lock it after development.

Allow bootloader unlocking only on devices that are not enrolled in the MDM and do not have access to corporate data.

Allow bootloader unlocking on all devices but require users to sign a waiver.

Prohibit bootloader unlocking on all devices, including personal ones.

A user wants to install a custom ROM on their Android device. They have already unlocked the bootloader. What is the next step in the process?

Enable USB debugging and connect to a PC.

Install a root-management app from the Play Store.

Flash a custom recovery such as TWRP.

A security team is evaluating methods to detect rooted Android devices in their enterprise. Which of the following are reliable indicators of rooting that an MDM or security tool can check? Select all that apply.

Bootloader status showing 'unlocked'.

A user's claim that they have not rooted the device.

Presence of root-management apps like Magisk Manager.

Presence of the 'su' binary in the system partition.

A security analyst is assessing the risk of a rooted device in the enterprise. Which risk is most directly increased by rooting?

The device is more likely to be lost or stolen.

Malware can gain persistent, elevated access to the device's data and functions.

The device's battery life will decrease significantly.

The device will no longer receive over-the-air updates.

GIAC Mobile Device Security Analyst

Domain 1Objective 4

Unlocking and Rooting Mobile Devices GMOB Practice Questions (Page 5)

Part of the Mobile Device Management and Security domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–28 in this domain), expect 5–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 21–25

21application · medium
A company allows employees to use personal Android devices for email and calendar access. The security team wants to permit rooted devices as long as corporate data is protected. Which policy approach best balances user flexibility with data protection?
Select an answer first
22application · medium
An organization is updating its mobile device policy. They want to allow users to unlock the bootloader for development purposes but still protect corporate data. Which policy statement best achieves this goal?
Select an answer first
23application · medium
A user wants to install a custom ROM on their Android device. They have already unlocked the bootloader. What is the next step in the process?
Select an answer first
24application · medium · select all that apply
A security team is evaluating methods to detect rooted Android devices in their enterprise. Which of the following are reliable indicators of rooting that an MDM or security tool can check? Select all that apply.
Select an answer first
25application · medium
A security analyst is assessing the risk of a rooted device in the enterprise. Which risk is most directly increased by rooting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.