ALISON Wireless & Mobile Security 2 — Questions and Answers
Question 1: What does MDM stand for in the context of enterprise mobile security?
- Mobile Data Management
- Mobile Device Management (Correct answer)
- Multi-Domain Monitoring
- Managed Device Module
Correct answer: Mobile Device Management
MDM (Mobile Device Management) is a solution that allows organizations to remotely manage, monitor, and enforce security policies on employee mobile devices.
Question 2: What is 'jailbreaking' a mobile device?
- Unlocking a carrier-locked phone to use any SIM
- Resetting a device to factory settings to remove malware
- Exploiting OS vulnerabilities to remove manufacturer/carrier restrictions and gain root access (Correct answer)
- Encrypting device storage to protect data at rest
Correct answer: Exploiting OS vulnerabilities to remove manufacturer/carrier restrictions and gain root access
Jailbreaking (iOS) or rooting (Android) involves exploiting OS vulnerabilities to gain privileged root access, bypassing built-in security controls and vetting mechanisms.
Question 3: What is a SIM swapping attack?
- Installing spyware via a malicious SIM card update
- Socially engineering a carrier into transferring a victim's phone number to an attacker-controlled SIM (Correct answer)
- Cloning a SIM card using RF eavesdropping equipment
- Intercepting SMS messages via a rogue cell tower
Correct answer: Socially engineering a carrier into transferring a victim's phone number to an attacker-controlled SIM
SIM swapping involves deceiving a mobile carrier's support staff into reassigning a victim's phone number to the attacker's SIM, enabling bypass of SMS-based MFA.
Question 4: What is the security purpose of certificate pinning in mobile applications?
- To encrypt all data stored in the app's local database
- To prevent the app from running on rooted or jailbroken devices
- To ensure the app only trusts specific certificates, preventing MITM attacks via rogue CAs (Correct answer)
- To bind the app license to a specific device's hardware ID
Correct answer: To ensure the app only trusts specific certificates, preventing MITM attacks via rogue CAs
Certificate pinning embeds expected certificate fingerprints in the app so it rejects connections that present different certificates, even if signed by a trusted CA, thwarting MITM interception.
Question 5: What is 'smishing' in mobile security?
- Sending malware via Bluetooth to nearby devices
- Phishing attacks delivered via SMS text messages (Correct answer)
- Exploiting vulnerabilities in smartphone browsers
- Installing spyware through malicious QR codes
Correct answer: Phishing attacks delivered via SMS text messages
Smishing (SMS phishing) involves sending deceptive text messages that trick recipients into clicking malicious links or providing sensitive information.
Question 6: Starting with Android 6.0 (Marshmallow), how were app permissions changed to improve security?
- All permissions were removed and replaced with a single app trust level
- Permissions were granted at install time in bulk with no granular control
- Dangerous permissions must be requested and granted individually at runtime (Correct answer)
- Permissions became device-wide rather than per-application
Correct answer: Dangerous permissions must be requested and granted individually at runtime
Android 6.0 introduced runtime permissions, requiring apps to request dangerous permissions (camera, contacts, location) individually when the feature is used, giving users granular control.
Question 7: What primary security risk does a BYOD (Bring Your Own Device) policy introduce in an enterprise environment?
- Increased hardware procurement costs for the IT department
- Loss of organizational control over device security posture and data handling (Correct answer)
- Mandatory compliance with consumer privacy laws for the employer
- Reduced network bandwidth due to personal device usage
Correct answer: Loss of organizational control over device security posture and data handling
BYOD reduces IT control over patching, encryption, and app installation on personal devices, creating risk that corporate data may be stored or transmitted insecurely.
ALISON Wireless & Mobile Security 2
What does MDM stand for in the context of enterprise mobile security?