CMT Security & Data Protection Standards 2 — Questions and Answers
Question 1: A customer brings in a phone for repair and requests that their data be backed up before servicing. Which encryption method should be used to protect the backup stored on a technician's workstation?
- Store it in a standard ZIP archive
- Use AES-256 encryption for the backup file (Correct answer)
- Copy files to a shared network folder
- Leave the backup unencrypted since it is temporary
Correct answer: Use AES-256 encryption for the backup file
AES-256 is the industry standard for encrypting sensitive data backups, providing strong protection against unauthorized access.
Question 2: Under COPPA (Children's Online Privacy Protection Act), what age threshold determines special data handling requirements for mobile apps?
- Under 16
- Under 18
- Under 13 (Correct answer)
- Under 10
Correct answer: Under 13
COPPA requires verifiable parental consent before collecting personal information from children under 13.
Question 3: A technician notices a mobile device is running an app with unusually high background data usage. What is the MOST likely security concern?
- The app needs a software update
- The app may be exfiltrating data to a remote server (Correct answer)
- The battery is failing and consuming more resources
- The OS is performing a routine cache clear
Correct answer: The app may be exfiltrating data to a remote server
Unexplained background data usage is a common indicator of spyware or malware transmitting device data to a command-and-control server.
Question 4: Which mobile device management (MDM) capability allows an IT administrator to erase corporate data from a personal employee device without deleting personal photos and apps?
- Full remote wipe
- Selective wipe (Correct answer)
- Factory reset
- Partition format
Correct answer: Selective wipe
Selective wipe (also called corporate wipe) removes only managed corporate data and apps while leaving personal content intact.
Question 5: What does the term 'data minimization' mean in the context of mobile app privacy standards?
- Compressing user data to reduce storage size
- Collecting only the data strictly necessary for the app's stated purpose (Correct answer)
- Deleting old user data after 30 days
- Encrypting data to minimize its readable footprint
Correct answer: Collecting only the data strictly necessary for the app's stated purpose
Data minimization is a core GDPR and privacy principle requiring apps to collect only data that is necessary for their specific function.
Question 6: A technician performing a screen replacement must boot the device into a diagnostic mode. Which security feature could prevent unauthorized access to the device during this process?
- Airplane mode
- Secure Boot / Bootloader lock (Correct answer)
- NFC disable
- Auto-brightness setting
Correct answer: Secure Boot / Bootloader lock
A locked bootloader enforces Secure Boot, preventing the device from booting unauthorized or modified OS images during repair.
Question 7: When disposing of a mobile device on behalf of a customer, which step is MOST critical to ensure data protection compliance?
- Remove the SIM card only
- Perform a factory reset and verify data destruction (Correct answer)
- Delete the user's Google or Apple account
- Uninstall all third-party apps
Correct answer: Perform a factory reset and verify data destruction
A factory reset followed by verification ensures all user data is wiped; simply removing accounts or apps does not fully protect against data recovery.
CMT Security & Data Protection Standards 2
A customer brings in a phone for repair and requests that their data be backed up before servicing.
Which encryption method should be used to protect the backup stored on a technician's workstation?