BYOD Phishing Mitigation via MDM and Training

312-50v12 By islever Editorial Last updated

Cloud Computing

Short answer

C Implement a mobile device management solution that restricts the installation of non-approved applications.

Question

You are a cybersecurity consultant for a global organization. The organization has adopted a Bring Your Own Device (BYOD)policy, but they have recently experienced a phishing incident where an employee's device was compromised. In the investigation, you discovered that the phishing attack occurred through a third-party email app that the employee had installed. Given the need to balance security and user autonomy under the BYOD policy, how should the organization mitigate the risk of such incidents? Moreover, consider a measure that would prevent similar attacks without overly restricting the use of personal devices.
  1. Provide employees with corporate-owned devices for work-related tasks.
  2. Require all employee devices to use a company-provided VPN for internet access.
  3. Implement a mobile device management solution that restricts the installation of non-approved applications. Correct Answer
  4. Conduct regular cybersecurity awareness training, focusing on phishing attacks.

Key Takeaways

The question tests the ability to identify technical controls that mitigate specific risks without violating BYOD policies, highlighting the trap of choosing training over technical enforcement when application control is feasible.

This question explores balancing security and user autonomy in a BYOD environment following a phishing incident. The correct approach involves implementing Mobile Device Management (MDM) to restrict non-approved applications while respecting personal device ownership.

Common mistake: Many learners choose D (Training) because they believe MDM is too restrictive for personal devices. However, training alone does not prevent the installation of malicious apps, which was the vector in this scenario.

Expert Analysis

Why the Answer Is Correct

Option C is the correct answer because it directly addresses the root cause: the installation of an unapproved third-party email app. Implementing a Mobile Device Management (MDM) solution allows the organization to enforce a whitelist or blacklist of applications on BYOD devices. This mitigates the risk of unauthorized apps compromising corporate data while still allowing employees to use their personal devices for other purposes, often through containerization that separates personal and business data.

Why the Other Options Are Wrong

Option A contradicts the premise of a BYOD policy; providing corporate devices shifts the model away from BYOD. Option B (VPN) secures the tunnel but does not prevent the initial compromise caused by a malicious app. Option D (Training) is important but insufficient as a standalone control because it relies on human behavior and does not technically prevent the installation of risky applications that could exfiltrate data.

Community Comment Notes

Several users argued that MDM is "overly restrictive" for personal devices, leading them to vote for D. As one commenter noted, "they don't have the rights to restrict me from downloading anything on my own device." However, in a professional context, accepting a BYOD policy typically implies agreeing to certain security controls like MDM profiles. Another user pointed out that "MDM fails in real life as users don't support the idea," but exam questions focus on ideal security architectures where MDM is the standard technical control for BYOD governance.

Exam Strategy

When analyzing BYOD questions, look for Mobile Device Management (MDM) as the primary technical control for enforcing security policies on personal devices. If the question mentions restricting specific actions like app installation or network access, MDM is usually the correct technical answer over awareness training, unless the question explicitly states that technical controls are not possible.

Frequently Asked Questions

Why is MDM allowed on personal devices?

BYOD policies typically require installing an MDM profile that manages only the corporate container/data, leaving personal data largely untouched.

Does training prevent phishing via apps?

No, training reduces susceptibility to social engineering but does not technically block the installation of malicious or unapproved applications.

More 312-50v12 FAQ →

Community Votes

D
58%
C
42%

58% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 24 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 24

  1. insaniunt 👍 4 Answered C
    C - Implement a Mobile Device Management (MDM) MDM provides platforms for over-the-air or wired distribution of applications, data, and configuration settings for all types of mobile devices, including mobile phones, smartphones, tablet computers, and so on. It helps in implementing enterprise-wide policies to reduce support costs, business discontinuity, and security risks. It helps system administrators to deploy and manage software applications across all enterprise mobile devices to secure, monitor, manage, and support these devices. It can be used to manage both company-owned and employee-owned (BYOD) devices across the enterprise. - Module 17 Page 2713
  2. Naif2030 👍 3 Answered D
    they don't have the rights to restrict me from downloading anything on my own device, otherwise they should buy me one. so the only valid answer here is D
  3. Bas375 👍 3
    BYOD is a personal device, MDM fails in real life as users don't support the idea. C would be preferred but D is more practical.
  4. ahmedalkibsy 👍 3 Answered D
    Because it is BYOD so, can't restrict the user.
  5. brrbrr 👍 2 Answered C
    C - Implement a Mobile Device Management (MDM) Mobile Device Management (MDM) is an effort to add some control to enterprise mobile devices. Much like Group Policy and such in the Microsoft Windows world, MDM helps in pushing security policies, application deployment, and monitoring of mobile devices. Most MDM solutions offer the same basic features: passcodes for device unlocking, remote locking, remote wipe, root or jailbreak detection, policy enforcement, inventory, and monitoring/reporting.
Show 19 more comments
  1. noyon2002 👍 2
    C The correct answer From CEH v12, p.2712 : Mobile Device management MDM is gaining considerable importance with the adoption of policies such as BYOD across organization ............................................ Moreover in the BYOD scenario two separates session one for business and one personal and the MDM will control only the business portion and not the personal
  2. tyw82 👍 2 Answered D
    While MDM should be implemented, the restriction of installation of non-approved applications does not solve this particular issue, because the problem is not with the app itself. No matter which email app you install on your phone, if the staff is not trained on phishing, he can still fall prey to email scams, including those on approved email apps.
  3. 0ea2cf3 👍 2
    D. Bring Your Own Device (BYOD), the device is the user's personal property if the owners of the device wants to put TikTok, Facebook, X, etc. it is the owner's personal property.
  4. calx5 👍 2 Answered C
    C The root cause was through a third-party email app that the employee had installed. Consider that the official provided apps with such protection and prevention.
  5. athicalacker 👍 2 Answered D
    Mobile device management solution (Option C )could be seen as overly restrictive in a BYOD environment. So I think its D.
  6. 7a0977f 👍 2
    I have to go with C. If in fact MDM can be applied to BYOD, then C is the correct answer. D mitigates nothing.
  7. qwerty100 👍 2 Answered D
    D. Conduct regular cybersecurity awareness training, focusing on phishing attacks. Module 09 Page 139
  8. Spam_Protection 👍 2 Answered C
    Module 17, page 1720: Develop a blacklist of all the restricted applications on BYOD device
  9. JR22craft 👍 2 Answered C
    C - Implement a Mobile Device Management (MDM) MDM works also in BYOD
  10. kennels 👍 1 Answered D
    I wouldn't install MDM to my phone. Most people don't want to install MDM on their smartphones because they won't be able to install their favorite apps. > consider a measure that would prevent similar attacks without overly restricting the use of personal devices
  11. lmourikis 👍 1
    According to the book, as stated by insaniunt (Module 17 Page 2713) it is C. However, in outside the context of the exam, for BYOD MDM is not recommended and companies prefer MAM (Mobile App Management) instead for such a scenario.
  12. 8utterFree 👍 1 Answered D
    Phishing attack is the main problem not the third-party email app in this scene.
  13. 0af6dbd 👍 1 Answered D
    when it comes to phishing, the same option is to make employees aware.
  14. Mabrow 👍 1
    D. i think C. MDM is good but make restrict use personal devices
  15. [Removed] 👍 1
    Could someone help me confirm the accuracy of this data
  16. Rami1996 👍 1 Answered C
    I think that MDM is the most suitable choice
  17. [Removed] 👍 1
    Team can you confirm if this is accurate
  18. 49f4430 👍 2 Answered D
    D, it has to be D
  19. qtygbapjpesdayazko 👍 1 Answered D
    D. i think

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide