Endpoint and mobile device security. It solves the problem of protecting every device that connects to a company's network, from laptops to smartphones. For the CAS-005 exam, this is where you learn how organisations stop hackers from using an employee's phone or laptop as a backdoor into the entire network.
Jump to a section
A simple way to picture Endpoint and Mobile Device Security
A site security officer for a large construction project. Their job is to protect every single piece of equipment, every material delivery, and every worker on the site. They don't just guard the main gate. They check the credentials of every delivery driver, they ensure that workers' hard hats and boots meet safety standards, they log every tool that leaves the workshop for repairs, and they use CCTV to watch for unauthorised access to the crane or the electrical room.
Now map that to endpoint and mobile device security. In IT, the "construction site" is your company's network. The "equipment" and "materials" are the endpoints: laptops, desktops, mobile phones, and servers. The "workers" are the employees and their devices. The security officer's role is performed by a suite of tools like Mobile Device Management (MDM) and Endpoint Detection and Response (EDR). The main gate is your firewall, but that's not enough because threats can come from inside (an infected USB drive) or from a device that's already inside the perimeter (a phone that downloaded a malicious app). The officer checking delivery drivers is like an MDM system vetting every new device that tries to connect to the network. The CCTV watching the crane room is like EDR continuously monitoring for suspicious behaviour, like a laptop suddenly encrypting files.
The key insight? You can't just secure the perimeter. You must secure every individual device, because any single one can be the point of entry for a ransomware attack.
Endpoint security is the practice of protecting every device that connects to a corporate network. An endpoint is any device that communicates back and forth with the network — think of laptops, desktop computers, smartphones, tablets, printers, and even smart thermostats in an office. Each one of these is a potential entry point for a cyber attacker. Mobile device security is a subset of endpoint security focused specifically on phones and tablets, which are often used outside the office and on untrusted Wi-Fi networks.
The central problem is that traditional network security — like a firewall at the edge of the network — treats the network as a castle with a single wall. But modern workers use devices everywhere: at home, in coffee shops, on aeroplanes. You cannot rely on the castle wall when the devices are outside the castle most of the time. This is where endpoint security tools come in.
There are three main technologies you need to understand for CAS-005: Antivirus (AV), Endpoint Detection and Response (EDR), and Mobile Device Management (MDM).
Antivirus is the oldest. It works by comparing files against a list of known threats, called virus signatures. If a file matches a known bad signature, the antivirus software blocks or quarantines it. The limitation is that it cannot catch new, unknown threats (zero-day exploits) because there's no signature for them yet.
EDR is an evolution of antivirus. Instead of just checking signatures, EDR software monitors the behaviour of files and processes on an endpoint. It looks for actions that are suspicious, like a word processor suddenly trying to read the entire system registry, or a program attempting to encrypt thousands of files in a minute. When it sees something unusual, it can alert a security analyst, or in some cases, automatically isolate the device from the network. EDR also records everything that happens, so analysts can go back and investigate how an attack started.
MDM is specifically for mobile devices. It allows an administrator to enforce policies on smartphones and tablets without having to physically touch them. For example, an organisation can require that all company phones have a screen lock PIN, encrypt their data, and cannot be jailbroken (rooted). If a phone is lost or stolen, the MDM can remotely wipe all company data from it. MDM tools often include Mobile Application Management (MAM), which controls which apps can be installed on the device and what data they can access.
A critical concept is that these tools are often combined. A modern endpoint protection platform (EPP) integrates AV, EDR, and sometimes MDM into a single console. The CAS-005 exam focuses on how to implement and manage these tools, not just what they do.
The exam also covers the lifecycle of an endpoint: enrollment, policy enforcement, monitoring, and decommissioning. Enrollment is how a device gets registered with the management system (usually by installing a profile). Policy enforcement is what rules are pushed to the device — for example, requiring disk encryption or blocking USB drives. Monitoring is the ongoing detection of threats. Decommissioning is what happens when the device is retired: you wipe it and remove it from the management system.
Finally, remember that user behaviour is part of endpoint security. Social engineering attacks often target mobile devices via phishing text messages (smishing). Therefore, security awareness training is considered a control in this domain, alongside technical controls.
Enroll the Device
Before a laptop or mobile phone can access company resources (email, files, VPN), it must be enrolled in the MDM system. A configuration profile is installed that defines policies such as passcode length, encryption requirement, and allowed apps. This step ensures only compliant devices connect.
Define and Push Security Policies
The administrator creates policies covering encryption, password complexity, OS update requirements, and app whitelisting. These policies are pushed to all enrolled devices automatically. If a device violates a policy (e.g., its OS is outdated), it can be blocked from accessing corporate resources.
Deploy Endpoint Detection and Response (EDR) Agent
On each endpoint, an EDR agent is installed silently. This agent monitors processes, file changes, network connections, and registry modifications in real time. It sends telemetry data to a central console where security analysts can spot malicious patterns. Crucially, the agent can take actions like killing a process or isolating the device from the network.
Monitor and Respond to Alerts
Security analysts in a Security Operations Centre (SOC) review alerts from the EDR console. Each alert includes a timeline and context (e.g., 'This process attempted to encrypt 500 files'). The analyst decides whether to contain the device (isolate it), investigate further, or ignore a false positive. This step is where threats are actually stopped.
Remediate and Recover
If a device was compromised, the analyst might kill the malicious process, remove associated files, and restore any encrypted or deleted files from backup. The device may need to be reimaged (OS reinstalled) if the infection was deep. After remediation, the device is scanned again and re-enrolled into management with possibly stricter policies.
Decommission the Device
When a device is retired, sold, or an employee leaves, the administrator performs a remote wipe of corporate data and then unenrolls the device from MDM. This prevents the device from accessing company resources in the future. For mobile devices, wiping is essential to prevent data theft if the device gets into the wrong hands.
An IT professional at a medium-sized company, let's call it "MidCo", has just been told that the CEO's laptop was infected with ransomware over the weekend. The CEO was working from a hotel in another country and clicked a link in an email that looked like it was from the company's travel agency. The ransomware encrypted all the files on the laptop and demanded a payment.
Here's what the IT professional does step by step:
First, they use the EDR console to isolate the CEO's laptop from the network immediately. They don't wait to call the CEO. The EDR tool has a "contain" button that tells the laptop's agent to block all inbound and outbound network traffic except to the EDR server itself. This stops the ransomware from spreading to the file server or other computers.
Second, they check the EDR timeline. This is a log of every process and network connection on the laptop for the past 48 hours. They see that the malicious email attachment was opened at 19:03. They see that the ransomware binary tried to communicate with an external IP address at 19:05 but the EDR blocked the connection because it recognised the IP as a known threat. They also see that encryption started at 19:06.
Third, they open the MDM console. The CEO also uses an iPad and an Android phone. The IT pro checks the MDM policies. The iPad has a policy that requires full disk encryption, which is good. But the Android phone does not have the latest security patch installed — it's missing a critical update. They push a command to force the phone to download and install the update.
Fourth, they review the enrollment profiles. They discover that the CEO's personal iPhone is also connected to the corporate network because it was enrolled under a Bring Your Own Device (BYOD) policy. The policy allows personal devices to access email only, not file shares. That's a good control, but the IT pro notices that the personal iPhone has no antivirus app installed. They push a policy that requires one.
Fifth, they generate a report from the EDR for the security manager, showing exactly what happened, the timeline, and the actions taken. This report will be used for a post-incident review and possibly to adjust policies.
In a real scenario, the IT pro would also:
Change the CEO's Active Directory password to revoke access tokens.
Check if the ransomware has any decryptors available.
Coordinate with the CEO to restore files from backups.
Document everything for compliance requirements.
This process shows how a combination of EDR, MDM, and policy enforcement works together. Without EDR, the ransomware might have spread to the entire network. Without MDM, the Android phone could have been a backdoor. Without proper enrollment policies, the personal iPhone would have no protection whatsoever.
The CAS-005 exam tests your ability to implement and manage endpoint protection, not just to define terms. Expect scenario-based questions where you must choose the right tool or policy for a given situation.
Key exam topics include:
The difference between AV, EDR, and EPP. A common question gives you a description of a tool's behaviour and asks you to categorise it. For example: "A security solution monitors file behaviour in real time and rolls back malicious changes." This is EDR, not AV.
MDM vs. MAM. Traps: They might describe an MDM function (like remote wipe) but call it MAM. MAM controls apps, MDM controls the whole device. MAM cannot wipe a device — it can only wipe the enterprise apps and their data.
The enrollment profile. They love to test what happens when a device is enrolled. The correct answer is that a configuration profile is installed that enforces policies. The trap is that they might say the device is immediately wiped, which is false unless it's a corporate-owned device set to "supervised" mode.
Policy enforcement for mobile devices. Items you must enforce include: passcode complexity (at least 6 characters, not 4), encryption enabled, OS updated to latest patch level, disable side-loading of apps (installing apps from outside the official app store).
Decommissioning. They test the difference between wiping and removing a device. Wiping deletes all data. Removing unenrolls it but leaves data. The correct answer for a lost device is to wipe it.
Threat detection vs. prevention. EDR is detection and response, not prevention. AV is prevention (stops known threats), EDR catches the unknown ones. A question might ask: "Which solution will stop a zero-day malware from executing?" The answer is that neither AV nor EDR alone can stop a zero-day from executing — AV doesn't know it, and EDR detects it after it runs. A better answer is a combination of application whitelisting and EDR.
The containment methods: network isolation (block all traffic), process isolation (kill the malicious process), and host firewall rules (block specific ports).
Always be aware of the "user" factor. A scenario where a user ignores a policy is about training and deterrent controls, not technical failure. The exam may ask: "What is the best control to prevent users from installing unauthorized apps?" The answer is not just MDM policy, but also user acceptance (AUP) and periodic audits.
Mobile device threats they test: smishing (SMS phishing), malicious QR codes, insecure Wi-Fi, jailbreaking/rooting, and app side-loading.
Lastly, they test compliance and reporting. You must know that endpoint security logs feed into a SIEM (Security Information and Event Management) system for correlation with other network events.
Endpoint security protects every device (endpoint) that connects to a corporate network, not just the network perimeter.
EDR detects unknown threats by monitoring behaviour, while traditional antivirus blocks known threats using signatures.
MDM enforces policies on mobile devices remotely, including requiring encryption, passcodes, and remote wipe on lost devices.
MAM controls only corporate apps and data, while MDM controls the entire device—know the difference for the exam.
Decommissioning an endpoint means wiping all corporate data and unenrolling it from management to prevent data leaks.
Enrollment profiles are configuration files installed on devices that enforce security policies before the device is allowed network access.
Side-loading of apps (installing from outside official stores) is a major mobile threat that MDM policies should block.
Endpoint protection must include hardware controls like TPM and BIOS passwords, not just software on the OS.
These come up on the exam all the time. Here's how to tell them apart.
Antivirus (AV)
Uses signature-based detection to block known malware.
Cannot detect zero-day or unknown threats.
Does not record behaviour logs for investigation.
Endpoint Detection and Response (EDR)
Uses behavioural analysis to detect unknown threats.
Can detect zero-day exploits by monitoring suspicious activity.
Records detailed logs for forensic analysis and incident response.
Mobile Device Management (MDM)
Controls the entire device: passcode, encryption, remote wipe.
Requires device enrollment; affects all apps and data.
More intrusive; suitable for corporate-owned devices.
Mobile Application Management (MAM)
Controls only enterprise apps and their data.
Does not require full device enrollment; works on personal devices.
Less intrusive; suitable for BYOD (Bring Your Own Device) scenarios.
Corporate-Owned, Personally Enabled (COPE)
Device is owned by the company but the employee can use it for personal tasks.
Organisation has full control and can wipe the entire device if lost.
Lower privacy for the employee; MDM can see more device details.
Bring Your Own Device (BYOD)
Device is owned by the employee; personal data stays private.
Organisation cannot wipe personal data, only corporate container.
Higher employee privacy; MDM is restricted to compliance checks only.
Prevention (Antivirus/Whitelisting)
Blocks threats before they execute (e.g., blocking a known hash).
Cannot stop a zero-day from running because it is unknown.
Reduces the attack surface by preventing known malware.
Detection (EDR)
Detects threats after they begin executing (e.g., unusual process behaviour).
Can stop a zero-day in its tracks once it starts behaving maliciously.
Provides visibility and context for incident response.
Mistake
Antivirus and EDR are the same thing, and an EDR replaces traditional antivirus completely.
Correct
EDR complements rather than replaces AV. AV provides signature-based detection for known malware; EDR provides behavioural detection for unknown threats. Most modern EPP suites include both layers.
Many beginners hear 'next-gen' and assume old methods are obsolete. In reality, signature-based AV still catches 90%+ of commodity malware, and removing it leaves a gap.
Mistake
If a mobile device is enrolled in MDM, it is fully secure and cannot be hacked.
Correct
MDM is a policy enforcement tool, not a silver bullet. It cannot prevent zero-day exploits on the device OS, nor can it block all phishing attempts or malicious SMS messages (smishing).
People assume that because a policy says 'encrypted' or 'passcode required', the device is invulnerable. But policy alone doesn't stop a user from clicking a malicious link.
Mistake
A remote wipe deletes everything on the device, including personal data, forever.
Correct
A remote wipe on a containerised or managed device only deletes the enterprise-managed partition and the MDM profile. Personal apps and data may remain unless the device is fully wiped (corporate-owned, supervised mode).
This misconception comes from conflating a factory reset with a managed wipe. In BYOD scenarios, organisations cannot legally or technically wipe personal data.
Mistake
Endpoint security is only about installing software on laptops and phones.
Correct
Endpoint security also includes hardware controls like TPM (Trusted Platform Module) for encryption key storage, physical security measures (locks, cable locks), USB port disabling, and BIOS/UEFI passwords.
Beginners focus on software because it's visible. They overlook that an attacker can physically boot a laptop from a USB drive and bypass all software controls if hardware security is weak.
Mistake
Once a device is enrolled in MDM, the IT team can see all your personal texts, photos, and browser history.
Correct
MDM can see device-level info (OS version, installed apps, encryption status) and enforce policies, but it cannot access personal app data on a containerised device unless the device is fully managed (corporate-owned, fully supervised).
This fear is common and sometimes exploited by vendors. The exam tests that you understand the privacy boundaries of BYOD vs. COPE (Corporate-Owned, Personally Enabled) models.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
MDM (Mobile Device Management) controls the entire device: it can enforce passcodes, wipe the whole device, and encrypt all data. MAM (Mobile Application Management) controls only specific corporate apps and the data within them — it cannot wipe the whole device.
No, on a properly configured BYOD (Bring Your Own Device) phone, a remote wipe only removes the corporate profile, apps, and data. Your personal photos and messages are left untouched because the device is containerised.
An EPP is a suite that combines antivirus, endpoint detection and response (EDR), and sometimes mobile device management (MDM) into one solution. It provides a single console for managing security on all endpoints.
EDR looks for suspicious behaviour, not just known file signatures. For example, if a word processor (like Microsoft Word) suddenly starts trying to read the Windows registry or encrypts thousands of files, the EDR flags it as suspicious even if the file itself is not known to be malicious.
A zero-day exploit is an attack that uses a vulnerability unknown to the software vendor. Traditional antivirus cannot block it because no signature exists. EDR may detect the behaviour after the exploit runs, but the best prevention is keeping all software patched and using application whitelisting to block unknown programs.
MDM is about policy and device control (locking, wiping, enforcing settings), while EDR is about threat detection and response (finding malware). They solve different problems. MDM won't detect ransomware; EDR won't enforce a passcode policy. Together, they provide coverage across the device lifecycle.
You've finished Endpoint and Mobile Device Security. Continue through the CAS-005 study guide to build a complete picture of the exam.
Done with this chapter?