MDM Features for Lost Mobile Device Security

SY0-601 By islever Editorial Last updated

Short answer

AB Configure screen locks to prevent unauthorized physical access and enable remote wipe to erase data from lost devices, mitigating social engineering risks.

Question

A company implemented an MDM policy to mitigate risks after repeated instances of employees losing company-provided mobile phones. In several cases, the lost phones were used maliciously to perform social engineering attacks against other employees. Which of the following MDM features should be configured to best address this issue? (Choose two.)
  1. Screen locks Correct Answer
  2. Remote wipe Correct Answer
  3. Full device encryption
  4. Push notifications
  5. Application management

Key Takeaways

The exam tests the hierarchy of device controls: physical access prevention (screen lock) is a prerequisite for encryption effectiveness, while remote wipe handles post-loss data protection.

This question examines MDM configurations to mitigate risks from lost company mobile phones used in social engineering attacks. The correct answer combines screen locks to prevent immediate unauthorized access and remote wipe to eliminate data exposure.

Common mistake: Many candidates choose Full Device Encryption (C) because it sounds more robust than screen locks, failing to realize that without a screen lock, an attacker can bypass encryption by accessing the device before it locks or by knowing the PIN.

Expert Analysis

Why the Answer Is Correct

Screen locks (A) are the first line of defense; they prevent an attacker who physically possesses the phone from immediately accessing apps, emails, or contacts to perform social engineering. Remote wipe (B) is the critical secondary control for lost devices, ensuring that if the device cannot be recovered, all corporate data is erased, rendering any stored information useless to the attacker. Together, they address both the immediate threat of access and the long-term risk of data leakage.

Why the Other Options Are Wrong

Full device encryption (C) is ineffective if the device is unlocked or has no screen lock, as the attacker can use the device before encryption kicks in or bypass it entirely. Push notifications (D) are informational and provide no security benefit against malicious use. Application management (E) controls app distribution but does not protect against physical theft or immediate unauthorized access to personal/company data.

Community Comment Notes

The community heavily favored AB, with many noting that encryption is irrelevant if the attacker knows the passcode or has physical access when the device is unlocked. One commenter noted, "FDE is nothing if the apple/android pin is known by snooping over a shoulder," highlighting the dependency on screen locks. Another argued that "Screen lock is more important than FDE" because it prevents the initial access required for social engineering.

Official Reference

  • NIST SP 800-124 (Revision 2): Guidelines for Managing and Securing Mobile Devices in the Enterprise
  • CIS Controls v8: Control 04 - Secure Configuration of Enterprise Assets and Software

These links open the official vendor documentation in a new tab.

Exam Strategy

When analyzing MDM questions, always look for the 'defense in depth' layers: first prevent access (lock screens), then protect data at rest (encryption), and finally remove data if lost (remote wipe). Prioritize controls that directly stop the specific attack vector described, such as social engineering via physical access.

Frequently Asked Questions

Why isn't Full Device Encryption the best answer?

Encryption protects data at rest, but if the device has no screen lock, an attacker can access it immediately upon finding it, bypassing encryption benefits until the device locks.

Does remote wipe help with social engineering?

Yes, by erasing corporate data, it removes the information an attacker might use to impersonate employees or gain trust during a social engineering attack.

More SY0-601 FAQ →

Community Votes

AB
65%
BC
35%

65% of anonymous learners picked answer AB. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 23 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 23

  1. johnabayot 👍 15
    B. Remote wipe C. Full device encryption The above two options are better options to solve the issue mentioned in the question than other options there.
  2. 1403ad2 👍 15
    choose AB felt good about this answer 2024-20-2 On Test and passed with 802
  3. DrCo6991 👍 5
    I believe A would prevent a malicious actor from using the information on the phone to target other employees. Without it, the device can be encrypted. However, the data can is still visible to the phone user. It's just useless when the data is not directly accessed from the device (aka dat exfil). Remote wipe is my second choice.
  4. Benrosan 👍 5
    Screen lock is more important than FDE. If the attacker has the code then FDE is irrelevant.
  5. ps1hacker 👍 5
    you can encrypt your device but it wont do much good if your phone doesn't lock lol
Show 18 more comments
  1. kewokil120 👍 4
    AB. Auto lock phones help prevent random apple picking. Always have the ability remote wipe FDE is nothing if the apple/android pin is known by snooping over a shoulder before picking them.
  2. ganymede 👍 3
    A. Screen locks B. Remote wipe "the lost phones were used maliciously to perform social engineering attacks against other employees" That would only been possible if the attacker with the stolen mobile device is able to get into the device and access employee information. If the device were screen locked, and also if the company data deleted via remote wipe, that risk would mitigated.
  3. caseymd85 👍 3
    Its A and B. Full disk encryption will not prevent social engineering. Geolocation also has nothing to do with it as well. The question specifically says how to prevent social engineering attacks. So a lock screen and remote wipe are the only correct responses.
  4. cannon 👍 3
    Gents, here's what ChatGP says: One thing to notice, Chat assumes that FDE means the phone is also locked, so A. Screen lock would be redundant. Correct Answers: B. Remote wipe C. Full device encryption
  5. StaticK9 👍 3
    After reading the comments. I have to go with A and B. Full disk encryption would be useless if you can access the device. Cant assume everyone puts a lock on their phone or mobile device.
  6. imnewtothis 👍 3
    BF - the issues isn't the social engineering attack; the issue is employees losing the phones. Geolocation will help them find them.
  7. ArunRavilla 👍 2
    I feel the answer must be screen locks and Remote wipe. The screen locks prevent the threat actors from performing social engineering on other employees. In the meantime providing admins enough time to take necessary actions such a remote wipe.
  8. kewokil120 👍 2
    AB with today standards. IOS/Androids are encrypted by default and that 99% of the market. I think A more likely than C.
  9. Mimikatz4Exam 👍 2
    Can “Screen Locks” prevent direct access to device storage such as "SSD" / "NAND flash memory". Can you explain guys?
  10. zero_pa 👍 2
    I have configured MDM policies myself and this is what I usually do to prevent this kind of scenarios.
  11. Gigi42 👍 1 Answered B
    The question is talking bout company provided devices only, and they want to prevent two things: 1. the device being lost (because it cost money to replace), and 2. company data If it does get lost, Geolocation can help locate the device and Remote Wipe can erase all company data, if company device does get compromise. This will prevent "lost phones from performing social media attacks"....as it says in the scenario.
  12. ThatDetroitGuy 👍 1
    C = Doesn't matter if the bad actor has the unlock code. D = WTF E = Doesn't matter if the phone is offline. F = That only helps to locate it (maybe).
  13. maggie22 👍 1
    B & C. Geolocation won't do anything to secure data of lost phones.
  14. Hs1208 👍 1
    B. Remote wipe C. Full device encryption
  15. Jhonattan0032 👍 3
    B and c is correct
  16. LuckyAro 👍 2
    B and C makes most sense.
  17. mikzer 👍 1
    Also see Q#216 to help.
  18. ekiel 👍 1
    b and c of course

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

MFA and Patch Management Control Type and Category

S-grade

Threat Hunting Data Sources for Exploitable Systems

S-grade

Full Weekly and Differential Daily Backup Strategy

S-grade

Access Auditing as the SaaS Vendor Risk to Focus On

S-grade

← Back to SY0-601 Study Guide