Mobile Devices practice questions

Pay the ransom to regain access quickly.

Why wrong: Paying the ransom is generally discouraged by cybersecurity experts and law enforcement for several critical reasons. There is no guarantee that the attackers will provide a working decryption key, and even if they do, the decryption process can be complex, incomplete, or introduce further vulnerabilities. Furthermore, paying directly funds criminal enterprises, encouraging more attacks and validating their illicit business model, which ultimately makes other potential victims more vulnerable.

Run a full antivirus scan to remove the malware.

Why wrong: While running a full antivirus scan is a necessary step for malware eradication, it does not address the immediate problem of already encrypted files. An antivirus program can detect and remove the ransomware executable, but it lacks the capability to reverse the cryptographic process that has rendered the user's data inaccessible. The primary concern in this scenario is data recovery, which an antivirus scan alone cannot achieve for data that has already been scrambled by encryption.

Restart the computer in Safe Mode and attempt file recovery.

Why wrong: Restarting the computer in Safe Mode does not provide any inherent mechanism to decrypt files that have been locked by ransomware. Safe Mode is designed to troubleshoot system issues by loading a minimal set of drivers and services, which can be useful for removing persistent malware or resolving driver conflicts. However, it does not magically restore access to cryptographically scrambled data, as the encryption key remains with the attacker, making the files unreadable regardless of the operating mode.

Samsung DeX

Why wrong: Samsung DeX is a software platform designed to extend the functionality of a single Samsung smartphone or tablet into a desktop-like computing experience when connected to an external display. While it enhances individual user productivity by enabling multitasking with a keyboard and mouse, it offers no capabilities for centralized bulk configuration, remote policy deployment, or application management across multiple devices. Therefore, it is unsuitable for deploying 50 Android tablets with consistent corporate settings.

Google Backup

Why wrong: Google Backup is a personal data recovery service that automatically saves user data, app data, and device settings associated with a specific Google account to Google Drive. Its primary function is to facilitate the restoration of an individual user's personal environment onto a new or reset device. This service lacks the enterprise-level features required for scalable, centralized deployment of corporate policies, security configurations, or mandatory applications across 50 distinct tablets, making it inappropriate for IT administration.

Developer Options > OEM Unlocking

Why wrong: OEM Unlocking is a specific setting found within a device's Developer Options, primarily intended for advanced users or developers to unlock the bootloader. Unlocking the bootloader allows for the installation of custom recovery images or alternative operating systems (custom ROMs), which fundamentally alters the device's security posture and voids manufacturer warranties. This feature is a security risk in an enterprise environment and provides no mechanism whatsoever for bulk configuration, centralized policy management, or secure application deployment across multiple corporate devices.

"I can install it, but you'll have to sign a waiver accepting all risks."

Why wrong: Installing company software on an unauthorized personal device, even with a signed waiver, directly violates established IT security policies and software licensing agreements. This action introduces significant security risks, such as potential data breaches, malware infections, and intellectual property theft, as personal devices typically lack the robust security controls of corporate assets. Furthermore, a waiver does not absolve the company of liability for security incidents stemming from non-compliant installations, making this an unprofessional and high-risk proposition.

"That's against policy. Please use a company laptop."

Why wrong: While correctly identifying that the request is against policy, this response is unhelpful and dismissive, failing to provide a constructive solution or alternative for the user. It lacks the professional communication necessary for effective IT support, potentially frustrating the user and hindering their ability to perform their job functions. A technician should aim to understand the user's underlying need and offer compliant solutions rather than simply stating policy without further assistance.

"I'll need to get approval from IT management first. Can you email the request?"

Why wrong: This response, while seemingly following a process, unnecessarily delays a resolution and implies that a policy violation might be permissible with management approval, which is often not the case for fundamental security policies. It shifts the burden of finding a solution entirely to the user and management, rather than the technician proactively offering a standard, policy-compliant alternative. A more effective approach would be to immediately offer a standard, policy-compliant solution, such as remote access, without involving unnecessary bureaucratic steps.

WPA2-PSK with a long passphrase.

Why wrong: WPA2-PSK (Pre-Shared Key) relies on a single, shared passphrase for all users to authenticate to the wireless network. While a long passphrase enhances resistance against brute-force attacks, this method inherently lacks individual user accountability and makes key management cumbersome and insecure for larger deployments. It does not provide the per-user authentication and authorization capabilities essential for robust enterprise or educational environments.

WPA2-Enterprise with 802.1X and RADIUS.

Why wrong: WPA2-Enterprise, leveraging 802.1X and a RADIUS server, provides robust individual user authentication and authorization, addressing the security limitations of shared keys. However, for a new wireless network deployment, WPA3-Enterprise is the superior and recommended choice. WPA3 offers significant cryptographic enhancements, including more resilient key establishment and protection against offline dictionary attacks, making WPA2-Enterprise a less optimal selection for future-proofing and maximum security.

WPA3-Personal with SAE.

Why wrong: WPA3-Personal, while introducing Simultaneous Authentication of Equals (SAE) for enhanced security over WPA2-Personal, still operates on the principle of a single, shared passphrase for network access. This fundamental design choice means it cannot provide the individual user authentication, authorization, and accountability required for enterprise or educational networks. It is primarily designed for home or small office environments where per-user security policies are not a critical requirement.

Enable WPS for easy device pairing.

Why wrong: Enabling Wi-Fi Protected Setup (WPS) simplifies device connection by allowing users to press a button or enter a short PIN. However, WPS is critically flawed due to a design vulnerability that allows brute-force attacks against its 8-digit PIN. This vulnerability can reveal the entire wireless network's passphrase in a matter of hours, making it a significant security risk. Therefore, enabling WPS compromises network security rather than enhancing it.

Disable SSID broadcast.

Why wrong: Disabling the Service Set Identifier (SSID) broadcast attempts to hide the network from casual observation, but it offers negligible security benefits. Tools readily available can easily detect non-broadcasting SSIDs, especially when client devices attempt to connect. Furthermore, hiding the SSID can complicate network setup and troubleshooting for legitimate users, as devices may struggle to automatically discover and connect to the network. It's a security theater rather than a robust defense.

Enable MAC address filtering.

Why wrong: Enabling MAC address filtering attempts to restrict network access to only devices with pre-approved Media Access Control (MAC) addresses. While seemingly secure, this method is easily circumvented because MAC addresses are transmitted unencrypted and can be readily spoofed by an attacker. An intruder can simply capture a legitimate MAC address from network traffic and configure their own device to use it, thereby bypassing the filter entirely. Consequently, MAC filtering provides a false sense of security and should not be relied upon as a primary defense.

Run 'ipconfig /release' followed by 'ipconfig /renew'.

Why wrong: The 'ipconfig /release' and 'ipconfig /renew' commands are used to obtain a new IP address from a DHCP server. While essential for resolving IP address conflicts or connectivity issues related to network configuration at the IP layer, these commands operate at the network layer (Layer 3) and do not address corruption within the Windows Sockets (Winsock) catalog. Winsock corruption, which affects how applications access network services, prevents the operating system from properly enumerating available networks, rendering IP renewal ineffective for this specific problem.

Run 'sfc /scannow' to check system files.

Why wrong: The 'sfc /scannow' command (System File Checker) is designed to scan for and repair corrupted or missing protected Windows system files. While crucial for maintaining operating system integrity and resolving issues stemming from damaged core files, it primarily focuses on file-level corruption. This utility does not specifically target or repair logical corruption within the network stack's configuration or the Winsock catalog, which is a database of network service providers, making it ineffective for an "empty network list" problem.

Run 'net start wlansvc' to start the WLAN AutoConfig service.

Why wrong: The 'net start wlansvc' command attempts to start the WLAN AutoConfig service, which is responsible for managing wireless network connections and profiles. While this service is essential for wireless functionality, merely starting it will not resolve underlying corruption within the Winsock catalog. If Winsock is corrupted, the system cannot properly utilize the WLAN AutoConfig service to enumerate networks, even if the service itself is running or successfully started. This command addresses service state, not network stack integrity.

The update installed a malware app; perform a factory reset.

Why wrong: Official system updates, especially from reputable manufacturers, undergo rigorous security checks to prevent the inclusion of malicious software. While not impossible, it is exceedingly rare for an official update to directly install malware that causes battery drain. Suggesting a factory reset as the immediate solution for post-update battery drain is an overreaction, as it erases all user data and settings without first exploring more common and less destructive troubleshooting steps.

The update reset battery optimization settings; re-enable them.

Why wrong: While a system update could theoretically reset some battery optimization settings, it is not the most common or immediate cause of significant battery drain directly after an update. Android's power management features are generally robust and designed to persist across updates. Furthermore, even if some settings were altered, the primary reason for post-update drain is usually background system activity rather than a complete disablement of all optimizations, making re-enabling them an incomplete solution.

The battery is failing due to the update; replace the battery.

Why wrong: A software update, by its very nature, cannot physically damage the chemical components or internal circuitry of a lithium-ion battery. Battery degradation is a physical process related to charge cycles, age, and heat exposure, not software changes. Attributing a sudden battery failure directly to a software update is a misconception, as the update only modifies the operating system's instructions, not the hardware's physical integrity. Therefore, replacing the battery is an inappropriate and premature solution for post-update battery drain.

Reset All Settings from the General > Reset menu.

Why wrong: Reset All Settings is a broad action that reverts all user-configured preferences across the entire iOS system, including display settings, privacy permissions, keyboard dictionaries, and accessibility options, back to their factory defaults. While it preserves user data and installed applications, it does not specifically target or clear network-specific caches or configurations like saved Wi-Fi passwords or cellular APN settings, making it an overly generalized and inconvenient step for a precise network connectivity issue.

Erase All Content and Settings to start fresh.

Why wrong: Erase All Content and Settings performs a complete factory reset, securely wiping all user data, installed applications, and system settings from the device. This action returns the iPhone to its out-of-the-box state, requiring a full setup process afterward. It is an extreme measure typically reserved for preparing a device for sale, transfer, or resolving severe, unrecoverable software corruption, making it entirely disproportionate and unnecessary for a simple Wi-Fi connectivity problem.

Restore the iPhone from an iCloud backup.

Why wrong: Restoring the iPhone from an iCloud backup replaces the current device's operating system, applications, user data, and all system settings with a snapshot from a previous backup point. If the underlying network configuration issue or corruption was already present within that specific backup, restoring from it would simply reintroduce the exact same problem. This process is also time-consuming and not a targeted diagnostic or troubleshooting step for isolating specific network faults.

Install a privacy screen on each POS terminal.

Why wrong: Installing a privacy screen on a POS terminal is a visual security measure designed to prevent "shoulder surfing" or unauthorized viewing of sensitive information displayed on the screen. However, it offers no protection against physical tampering with the device itself. A privacy screen does not deter or detect attempts to open the terminal casing, access internal components, or connect unauthorized devices to its ports, which are common methods of physical compromise.

Require a smart card to power on the terminal.

Why wrong: Requiring a smart card to power on a POS terminal is a strong logical access control, ensuring that only authorized personnel can boot and operate the system. While it prevents unauthorized users from accessing the operating system or applications, it does not provide any physical security for the hardware itself. An attacker could still physically open the terminal, access internal components, or connect malicious devices to external ports without ever powering on the system or needing the smart card.

Enable a screensaver with a password.

Why wrong: Enabling a screensaver with a password is a logical security control intended to protect an active user session from unauthorized access when the terminal is left unattended. It locks the software interface, requiring re-authentication to resume work. However, this measure provides no physical protection for the POS hardware. It does not prevent an attacker from physically manipulating the device, accessing its ports, or opening the casing to install unauthorized hardware or modify internal components.

Pay the ransom to recover the files immediately.

Why wrong: Paying the ransom is strongly discouraged as it directly funds criminal enterprises and provides no guarantee that the decryption key will be provided or will even work correctly. Engaging with cybercriminals also signals that your organization is a willing target, potentially leading to future attacks. This action does not resolve the underlying security vulnerability that allowed the ransomware in the first place, leaving the system susceptible.

Run a full antivirus scan to remove the malware.

Why wrong: Running a full antivirus scan, while part of the eradication phase, is not the immediate priority when ransomware is detected. The primary damage, file encryption, has already occurred, and performing a scan without prior network isolation risks the ransomware spreading further across the network before it can be fully removed. Furthermore, antivirus software typically removes the malware but does not possess the capability to decrypt files without the original key, which is held by the attacker.

Reboot the computer into Safe Mode.

Why wrong: Rebooting into Safe Mode can be a useful step for malware removal by loading only essential system components, potentially preventing the ransomware's full execution and making it easier to clean. However, it does not address the critical immediate threat of network propagation, as the system might still attempt network connections during the reboot process or upon entering Safe Mode. The priority is to contain the threat by isolating the system from the network *before* attempting any diagnostic or removal procedures that involve rebooting.

Certificates are easier to configure and manage than PSK.

Why wrong: While pre-shared keys (PSK) rely on a static shared secret that must be distributed and stored on each endpoint, certificate-based authentication uses a public-key infrastructure (PKI) to bind a device’s identity to a private key, eliminating the shared-secret vulnerability. This option is tempting because centralised certificate management can reduce manual key rotation overhead in large deployments, but the auditor’s concern is specifically the cryptographic weakness of PSK—not administrative convenience—so ease of configuration does not address the security gap.

Certificates eliminate the need for a VPN server.

Why wrong: Certificates serve as an authentication mechanism within a Virtual Private Network (VPN) solution, verifying the identity of clients or servers to ensure only authorized entities connect. However, they do not replace the fundamental role of a VPN server, which is responsible for establishing, managing, and terminating the encrypted tunnel, as well as routing traffic securely between the remote client and the internal network. The VPN server is a core component that certificates enhance, not eliminate.

Certificates are faster than PSK for establishing VPN connections.

Why wrong: Establishing VPN connections using certificates is generally slower than using pre-shared keys (PSK) due to the inherent computational overhead of asymmetric cryptography. Certificate-based authentication requires complex cryptographic operations, including public key decryption, signature verification, and often a certificate chain validation against a Certificate Authority. This process is significantly more resource-intensive and time-consuming than the simpler symmetric key comparison involved with a PSK.

Enable Guest Mode from the user switcher.

Why wrong: Guest Mode on Android creates a temporary, ephemeral user profile that is cleared upon exit, providing a clean slate for a temporary user. While it isolates the guest's data from the primary user, it does not inherently restrict the guest to a single application. A user in Guest Mode retains the ability to navigate the device's home screen, open various installed applications, and access system settings, which is contrary to the requirement of locking the device to a specific inventory app.

Set up a separate user account with restricted profile.

Why wrong: A restricted profile on Android allows an administrator to create a secondary user account with granular control over which applications are accessible. While this feature can prevent access to specific apps or content, it does not enforce a single-application lock. Users operating under a restricted profile can still switch between any of the applications explicitly permitted by the administrator, navigate the home screen, and potentially access certain limited settings, which fails to meet the requirement of confining the device to just the inventory application.

Activate Factory Reset Protection (FRP).

Why wrong: Factory Reset Protection (FRP) is a security feature designed to prevent unauthorized individuals from using a device after it has been factory reset. It requires the previous Google account credentials to be entered before the device can be set up and used again, effectively acting as an anti-theft measure. However, FRP has no bearing on the device's operational state or the applications accessible during normal, active use, and therefore offers no mechanism to restrict a user to a single inventory application.

Check if the router is using MAC address filtering.

Why wrong: MAC address filtering is a network security feature configured on the wireless access point or router, designed to permit or deny network access based on a device's unique hardware address. While it could prevent a phone from connecting, it's a less common configuration for general Wi-Fi networks and would typically affect *all* new devices unless specifically added. If other devices are connecting successfully, it's highly improbable that MAC filtering is the sole reason *this specific* Android phone cannot connect, making it a lower-priority troubleshooting step compared to client-side authentication issues.

Reset the phone's network settings to default.

Why wrong: Resetting the phone’s network settings clears saved Wi-Fi profiles, Bluetooth pairings, and VPN configurations, but it does not address authentication failures caused by mismatched corporate credentials, certificate trust issues, or an incorrect Extensible Authentication Protocol (EAP) method on the device. This step is tempting because it resolves many connectivity problems stemming from corrupted or conflicting network configurations, and would be correct if the phone had previously connected to a different network with incompatible settings that now interfere with the corporate SSID.

Update the phone's operating system to the latest version.

Why wrong: Updating the phone's operating system (OS) to the latest version, while beneficial for security patches and new features, is generally not the immediate first step for a basic Wi-Fi connection failure. While an extremely outdated OS *could* theoretically have compatibility issues with newer Wi-Fi standards or security protocols, it's a far less common cause than an incorrect password. Furthermore, an OS update can be time-consuming and may introduce new variables, making it an inappropriate initial diagnostic action for a simple authentication problem.

Pay the ransom to get the decryption key.

Why wrong: Paying the ransom is strongly discouraged because it provides no guarantee that a working decryption key will be provided, leaving the user's files still encrypted. Furthermore, it financially supports criminal organizations, encouraging them to perpetuate future attacks against other victims. This action does not resolve the underlying security vulnerability that allowed the ransomware to infect the system.

Run a full antivirus scan immediately.

Why wrong: Running a full antivirus scan immediately, while the PC remains connected to the network, is premature and potentially dangerous. The primary concern is that the active ransomware could continue to encrypt network shares or spread laterally to other systems before the scan completes or identifies the threat. Isolation of the infected machine must be the first step to contain the damage and prevent further compromise.

Restore files from a recent backup without disconnecting.

Why wrong: Restoring files from a recent backup without first disconnecting the PC from the network is highly risky and ineffective. If the ransomware process is still active on the system and the network connection remains, any restored files, especially those on network shares or cloud drives, could be immediately re-encrypted. The active threat must be neutralized and contained before attempting any restoration to ensure the integrity of the recovered data.

Virtual Private Network (VPN) with split tunneling.

Why wrong: A Virtual Private Network (VPN) primarily establishes an encrypted tunnel for network traffic, securing communication between the device and the corporate network. However, it does not provide granular management capabilities over the device itself, nor does it segregate corporate data from personal data on the endpoint. Split tunneling further compromises security by allowing non-corporate traffic to bypass the VPN, potentially exposing corporate data to unsecure networks without IT oversight or the ability to perform a selective wipe.

Remote Desktop Protocol (RDP) to a virtual desktop.

Why wrong: While Remote Desktop Protocol (RDP) to a virtual desktop centralizes corporate data on the server, preventing it from residing directly on the smartphone, it is not a comprehensive mobile device management solution. This approach does not manage the smartphone itself, enforce device-level security policies, or provide a unified experience for all corporate applications. Users would still likely access other corporate resources, such as email, directly on their mobile device, bypassing the virtual desktop and leaving corporate data unmanaged on the phone.

Third-party remote access software like LogMeIn.

Why wrong: Third-party remote access software, such as LogMeIn, is designed primarily for remotely controlling a desktop computer from another device, not for managing or securing corporate data on a mobile device itself. These tools lack the essential features of an MDM solution, including device enrollment, granular policy enforcement, application management, data containerization, or the ability to perform a selective wipe of corporate data on the mobile endpoint. They offer no control over the mobile device's security posture or the segregation of data.

The router's firmware is outdated.

Why wrong: Outdated firmware can indeed lead to various network instabilities, performance issues, or security vulnerabilities. However, the problem's sudden appearance immediately after a user-initiated change to the security mode strongly suggests a direct consequence of that configuration alteration, rather than a pre-existing or latent firmware bug. While a firmware update might be good general maintenance, it's not the most direct or probable cause for a connectivity failure specifically tied to a security mode change.

The devices do not support the new encryption cipher.

Why wrong: WPA2-Enterprise, like WPA2-Personal (PSK), primarily utilizes the Advanced Encryption Standard (AES) for data confidentiality, which is a widely adopted and supported encryption cipher across virtually all modern Wi-Fi devices. The issue is not with the encryption method itself, but rather with the underlying authentication mechanism. Devices are likely failing to establish a connection because they cannot complete the necessary authentication steps, not because they lack support for AES.

The SSID was changed during the configuration.

Why wrong: If the Service Set Identifier (SSID), or network name, had been changed, devices would simply no longer see the old network name and would need to be manually reconfigured to connect to the new SSID. However, the customer's description specifically states they changed the "security mode," implying the SSID remained the same. The problem is not that the network is invisible or renamed, but that devices cannot successfully authenticate to the existing network.

The phone's IMEI is blacklisted.

Why wrong: A blacklisted International Mobile Equipment Identity (IMEI) indicates that the device has been reported as lost, stolen, or involved in fraudulent activity. When an IMEI is blacklisted by a carrier or a central database, the network will typically deny all cellular services to that specific device, including voice calls, mobile data, and SMS. Therefore, if only SMS functionality is failing while other services like calls and data work, an IMEI blacklist is an unlikely cause.

The mobile data APN settings are incorrect.

Why wrong: Access Point Name (APN) settings are essential configurations that define how a mobile device connects to the internet and accesses multimedia messaging services (MMS) through the carrier's network. Incorrect APN settings would prevent the phone from accessing mobile data for web browsing, app usage, and sending/receiving MMS messages. However, basic Short Message Service (SMS) operates over the cellular control channel and does not rely on APN settings, so its failure would not be attributed to APN issues if data and calls are working.

The phone is in airplane mode.

Why wrong: When a phone is placed into airplane mode, it intentionally disables all wireless communication radios, including cellular (voice, SMS, data), Wi-Fi, and Bluetooth. This comprehensive shutdown is designed to prevent interference with aircraft systems and conserve battery. If the phone were in airplane mode, it would be unable to make or receive calls, access mobile data, or send/receive SMS messages, making it an unlikely cause if only SMS is failing while other cellular functions are operational.

The device's SD card is corrupted.

Why wrong: If an SD card were corrupted, the user would typically encounter specific error messages related to external storage access, such as "SD card unreadable" or "corrupted storage." An "insufficient storage" error during app installation almost always refers to the device's internal storage, where applications are primarily installed by default. Furthermore, simply deleting files from internal storage would not resolve a corruption issue on an external SD card, as corruption requires formatting or repair.

The app is incompatible with the Android version.

Why wrong: An application incompatible with the device's Android version would trigger a distinct error message during the installation attempt, such as "App not compatible with your device" or "This app requires a newer version of Android." The operating system performs compatibility checks before allowing the installation process to proceed. An "insufficient storage" error explicitly indicates a lack of available disk space, not a mismatch in software versions or hardware requirements.

The tablet's battery is too low to complete the installation.

Why wrong: While a critically low battery can indeed prevent various system operations, including app installations, the Android operating system is designed to provide specific warnings in such scenarios. A low battery condition would typically trigger a notification like "Low battery, connect charger" or "Installation paused due to low battery," rather than an "insufficient storage" error message. The error message directly points to a storage capacity issue, not a power supply problem.

Vishing

Why wrong: Vishing, a portmanteau of "voice" and "phishing," is a social engineering attack conducted exclusively over telephone calls. Attackers use deceptive voice messages or live conversations to trick individuals into divulging sensitive information, such as bank account details, credit card numbers, or login credentials, by impersonating legitimate entities. Since the user in the question clicked a link in a text message, rather than interacting via a voice call, vishing is not the correct term for this specific attack vector.

Pharming

Why wrong: Pharming is a cyberattack that redirects users from legitimate websites to fraudulent ones without their explicit knowledge or interaction, often by manipulating Domain Name System (DNS) resolution or modifying local host files. Unlike phishing, pharming does not require the user to click a malicious link in an email or text message; instead, the redirection occurs automatically when the user attempts to access a legitimate site. The scenario described, where the user actively clicked a link, indicates an explicit user interaction not characteristic of pharming's passive redirection.

Pretexting

Why wrong: Pretexting is a social engineering technique where an attacker creates a fabricated scenario, or "pretext," to manipulate a victim into divulging information or performing an action. This often involves impersonating someone in authority or a trusted individual to gain the victim's confidence through a convincing story, typically over the phone or in person. While a text message might be part of a broader pretexting scheme, the core of pretexting is the elaborate narrative and deception to extract information, whereas the question specifically highlights clicking a malicious link in a text message as the primary attack vector.

The phone's SIM card is faulty.

Why wrong: A SIM card's primary function is to authenticate a mobile device to a cellular network for services like voice calls, SMS, and mobile data. Wi-Fi connectivity, however, operates on a distinct radio frequency (802.11 standards) and network stack, entirely independent of cellular infrastructure. Therefore, a faulty SIM card would only impact cellular-dependent services, not the phone's ability to connect to or maintain a Wi-Fi connection.

The Wi-Fi network password was changed recently.

Why wrong: If the Wi-Fi network password were recently changed, the iPhone would fail to authenticate and connect to the network at all, rather than repeatedly connecting and then disconnecting. The device would continuously attempt to use the outdated credentials, resulting in persistent authentication errors or a prompt for the correct password. The symptom of intermittent disconnections implies successful initial connections, which contradicts a simple password mismatch.

The phone's operating system needs a full restore via iTunes.

Why wrong: A full restore via iTunes reinstalls the entire iOS firmware, which addresses deep file-system corruption or boot-loop issues, not intermittent Wi-Fi disconnections caused by transient radio interference or DHCP lease conflicts. This option is tempting because iTunes restores can resolve persistent software faults, and would be correct if the phone failed to boot or exhibited kernel panics, but the stem describes a functional device with a specific connectivity symptom.