MDM Features for Lost Mobile Device Security
A company implemented an MDM policy to mitigate risks after repeated instances of employees losing company-provided mobile phones. In several cases, the lost phones were used maliciously to perform social engineering attacks against other employees. Which of the following MDM features should be configured to best address this issue? (Choose two.)
Community Votes
65% of anonymous learners picked answer AB. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the hierarchy of device controls: physical access prevention (screen lock) is a prerequisite for encryption effectiveness, while remote wipe handles post-loss data protection.
This question examines MDM configurations to mitigate risks from lost company mobile phones used in social engineering attacks. The correct answer combines screen locks to prevent immediate unauthorized access and remote wipe to eliminate data exposure.
Many candidates choose Full Device Encryption (C) because it sounds more robust than screen locks, failing to realize that without a screen lock, an attacker can bypass encryption by accessing the device before it locks or by knowing the PIN.
Community Discussion (23 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Screen locks (A) are the first line of defense; they prevent an attacker who physically possesses the phone from immediately accessing apps, emails, or contacts to perform social engineering. Remote wipe (B) is the critical secondary control for lost devices, ensuring that if the device cannot be recovered, all corporate data is erased, rendering any stored information useless to the attacker. Together, they address both the immediate threat of access and the long-term risk of data leakage.Why the Other Options Are Wrong
Full device encryption (C) is ineffective if the device is unlocked or has no screen lock, as the attacker can use the device before encryption kicks in or bypass it entirely. Push notifications (D) are informational and provide no security benefit against malicious use. Application management (E) controls app distribution but does not protect against physical theft or immediate unauthorized access to personal/company data.Community Comment Notes
The community heavily favored AB, with many noting that encryption is irrelevant if the attacker knows the passcode or has physical access when the device is unlocked. One commenter noted, "FDE is nothing if the apple/android pin is known by snooping over a shoulder," highlighting the dependency on screen locks. Another argued that "Screen lock is more important than FDE" because it prevents the initial access required for social engineering.Official Reference
- NIST SP 800-124 (Revision 2): Guidelines for Managing and Securing Mobile Devices in the Enterprise
- CIS Controls v8: Control 04 - Secure Configuration of Enterprise Assets and Software
Exam Strategy
When analyzing MDM questions, always look for the 'defense in depth' layers: first prevent access (lock screens), then protect data at rest (encryption), and finally remove data if lost (remote wipe). Prioritize controls that directly stop the specific attack vector described, such as social engineering via physical access.
Frequently Asked Questions
Why isn't Full Device Encryption the best answer?
Encryption protects data at rest, but if the device has no screen lock, an attacker can access it immediately upon finding it, bypassing encryption benefits until the device locks.
Does remote wipe help with social engineering?
Yes, by erasing corporate data, it removes the information an attacker might use to impersonate employees or gain trust during a social engineering attack.