Mobile Devices practice questions

The user needs to sign out of iCloud and sign back in

Why it fails: Signing out of iCloud and back in refreshes account state; it does not lift a supervised device's App Store installation restriction. It is tempting as a generic iOS account fix, correct for sync or activation issues. The block comes from a configuration profile or MDM restriction, so the app must be assigned through managed distribution.

Perform a factory reset to remove supervision

Why it fails: Supervision is a permanent device enrolment state; a factory reset does not remove it and would simply re-enrol the device, wiping user data for nothing. It is tempting because resets often clear configuration faults, and would be correct only for removing a personal device from unmanaged use, not bypassing a corporate App Store restriction.

Enable 'Allow Untrusted Shortcuts' in Settings

Why it fails: Allow Untrusted Shortcuts governs the Shortcuts app's automation permissions, not App Store installation on a supervised device. It is tempting because it is an iOS restriction toggle, correct when a user must run unsigned shortcuts. The block stems from a device restriction or MDM assignment requiring the app via managed distribution.

Enable the 'Removable Storage Access' policy under Windows Components

Why it fails: Removable Storage Access policies deny read or write classes such as USB, but cannot allow specific approved hardware IDs. It tempts because it targets removable storage directly, and would be correct when blocking all USB storage outright rather than permitting an approved list.

Configure the 'Devices: Restrict CD-ROM access to locally logged-on user only' policy

Why it fails: This policy only restricts CD-ROM and DVD access to the locally logged-on user; it does not evaluate USB hardware IDs or block unauthorised storage. It is tempting because it addresses removable media access, and would be correct when limiting optical drive sharing between concurrent local and remote sessions.

Set the 'Deny all devices' policy under Device Installation Restrictions

Why it fails: Deny all devices blocks every device installation, including the approved USB storage, so no allow-list can operate. It is tempting as the strictest lockdown, and would be correct in a high-security environment where no removable storage is ever permitted.

Pay the ransom to regain access quickly.

Why it fails: Paying the ransom is generally discouraged by cybersecurity experts and law enforcement for several critical reasons. There is no guarantee that the attackers will provide a working decryption key, and even if they do, the decryption process can be complex, incomplete, or introduce further vulnerabilities. Furthermore, paying directly funds criminal enterprises, encouraging more attacks and validating their illicit business model, which ultimately makes other potential victims more vulnerable.

Run a full antivirus scan to remove the malware.

Why it fails: While running a full antivirus scan is a necessary step for malware eradication, it does not address the immediate problem of already encrypted files. An antivirus program can detect and remove the ransomware executable, but it lacks the capability to reverse the cryptographic process that has rendered the user's data inaccessible. The primary concern in this scenario is data recovery, which an antivirus scan alone cannot achieve for data that has already been scrambled by encryption.

Restart the computer in Safe Mode and attempt file recovery.

Why it fails: Restarting the computer in Safe Mode does not provide any inherent mechanism to decrypt files that have been locked by ransomware. Safe Mode is designed to troubleshoot system issues by loading a minimal set of drivers and services, which can be useful for removing persistent malware or resolving driver conflicts. However, it does not magically restore access to cryptographically scrambled data, as the encryption key remains with the attacker, making the files unreadable regardless of the operating mode.

Samsung DeX

Why it fails: Samsung DeX is a software platform designed to extend the functionality of a single Samsung smartphone or tablet into a desktop-like computing experience when connected to an external display. While it enhances individual user productivity by enabling multitasking with a keyboard and mouse, it offers no capabilities for centralized bulk configuration, remote policy deployment, or application management across multiple devices. Therefore, it is unsuitable for deploying 50 Android tablets with consistent corporate settings.

Google Backup

Why it fails: Google Backup is a personal data recovery service that automatically saves user data, app data, and device settings associated with a specific Google account to Google Drive. Its primary function is to facilitate the restoration of an individual user's personal environment onto a new or reset device. This service lacks the enterprise-level features required for scalable, centralized deployment of corporate policies, security configurations, or mandatory applications across 50 distinct tablets, making it inappropriate for IT administration.

Developer Options > OEM Unlocking

Why it fails: OEM Unlocking is a specific setting found within a device's Developer Options, primarily intended for advanced users or developers to unlock the bootloader. Unlocking the bootloader allows for the installation of custom recovery images or alternative operating systems (custom ROMs), which fundamentally alters the device's security posture and voids manufacturer warranties. This feature is a security risk in an enterprise environment and provides no mechanism whatsoever for bulk configuration, centralized policy management, or secure application deployment across multiple corporate devices.

"I can install it, but you'll have to sign a waiver accepting all risks."

Why it fails: Installing company software on an unauthorized personal device, even with a signed waiver, directly violates established IT security policies and software licensing agreements. This action introduces significant security risks, such as potential data breaches, malware infections, and intellectual property theft, as personal devices typically lack the robust security controls of corporate assets. Furthermore, a waiver does not absolve the company of liability for security incidents stemming from non-compliant installations, making this an unprofessional and high-risk proposition.

"That's against policy. Please use a company laptop."

Why it fails: While correctly identifying that the request is against policy, this response is unhelpful and dismissive, failing to provide a constructive solution or alternative for the user. It lacks the professional communication necessary for effective IT support, potentially frustrating the user and hindering their ability to perform their job functions. A technician should aim to understand the user's underlying need and offer compliant solutions rather than simply stating policy without further assistance.

"I'll need to get approval from IT management first. Can you email the request?"

Why it fails: This response, while seemingly following a process, unnecessarily delays a resolution and implies that a policy violation might be permissible with management approval, which is often not the case for fundamental security policies. It shifts the burden of finding a solution entirely to the user and management, rather than the technician proactively offering a standard, policy-compliant alternative. A more effective approach would be to immediately offer a standard, policy-compliant solution, such as remote access, without involving unnecessary bureaucratic steps.

WPA2-PSK with a long passphrase.

Why it fails: WPA2-PSK (Pre-Shared Key) relies on a single, shared passphrase for all users to authenticate to the wireless network. While a long passphrase enhances resistance against brute-force attacks, this method inherently lacks individual user accountability and makes key management cumbersome and insecure for larger deployments. It does not provide the per-user authentication and authorization capabilities essential for robust enterprise or educational environments.

WPA2-Enterprise with 802.1X and RADIUS.

Why it fails: WPA2-Enterprise, leveraging 802.1X and a RADIUS server, provides robust individual user authentication and authorization, addressing the security limitations of shared keys. However, for a new wireless network deployment, WPA3-Enterprise is the superior and recommended choice. WPA3 offers significant cryptographic enhancements, including more resilient key establishment and protection against offline dictionary attacks, making WPA2-Enterprise a less optimal selection for future-proofing and maximum security.

WPA3-Personal with SAE.

Why it fails: WPA3-Personal, while introducing Simultaneous Authentication of Equals (SAE) for enhanced security over WPA2-Personal, still operates on the principle of a single, shared passphrase for network access. This fundamental design choice means it cannot provide the individual user authentication, authorization, and accountability required for enterprise or educational networks. It is primarily designed for home or small office environments where per-user security policies are not a critical requirement.

Enable WPS for easy device pairing.

Why it fails: Enabling Wi-Fi Protected Setup (WPS) simplifies device connection by allowing users to press a button or enter a short PIN. However, WPS is critically flawed due to a design vulnerability that allows brute-force attacks against its 8-digit PIN. This vulnerability can reveal the entire wireless network's passphrase in a matter of hours, making it a significant security risk. Therefore, enabling WPS compromises network security rather than enhancing it.

Disable SSID broadcast.

Why it fails: Disabling the Service Set Identifier (SSID) broadcast attempts to hide the network from casual observation, but it offers negligible security benefits. Tools readily available can easily detect non-broadcasting SSIDs, especially when client devices attempt to connect. Furthermore, hiding the SSID can complicate network setup and troubleshooting for legitimate users, as devices may struggle to automatically discover and connect to the network. It's a security theater rather than a robust defense.

Enable MAC address filtering.

Why it fails: Enabling MAC address filtering attempts to restrict network access to only devices with pre-approved Media Access Control (MAC) addresses. While seemingly secure, this method is easily circumvented because MAC addresses are transmitted unencrypted and can be readily spoofed by an attacker. An intruder can simply capture a legitimate MAC address from network traffic and configure their own device to use it, thereby bypassing the filter entirely. Consequently, MAC filtering provides a false sense of security and should not be relied upon as a primary defense.

Run 'ipconfig /release' followed by 'ipconfig /renew'.

Why it fails: The 'ipconfig /release' and 'ipconfig /renew' commands are used to obtain a new IP address from a DHCP server. While essential for resolving IP address conflicts or connectivity issues related to network configuration at the IP layer, these commands operate at the network layer (Layer 3) and do not address corruption within the Windows Sockets (Winsock) catalog. Winsock corruption, which affects how applications access network services, prevents the operating system from properly enumerating available networks, rendering IP renewal ineffective for this specific problem.

Run 'sfc /scannow' to check system files.

Why it fails: The 'sfc /scannow' command (System File Checker) is designed to scan for and repair corrupted or missing protected Windows system files. While crucial for maintaining operating system integrity and resolving issues stemming from damaged core files, it primarily focuses on file-level corruption. This utility does not specifically target or repair logical corruption within the network stack's configuration or the Winsock catalog, which is a database of network service providers, making it ineffective for an "empty network list" problem.

Run 'net start wlansvc' to start the WLAN AutoConfig service.

Why it fails: The 'net start wlansvc' command attempts to start the WLAN AutoConfig service, which is responsible for managing wireless network connections and profiles. While this service is essential for wireless functionality, merely starting it will not resolve underlying corruption within the Winsock catalog. If Winsock is corrupted, the system cannot properly utilize the WLAN AutoConfig service to enumerate networks, even if the service itself is running or successfully started. This command addresses service state, not network stack integrity.

The update installed a malware app; perform a factory reset.

Why it fails: Official system updates, especially from reputable manufacturers, undergo rigorous security checks to prevent the inclusion of malicious software. While not impossible, it is exceedingly rare for an official update to directly install malware that causes battery drain. Suggesting a factory reset as the immediate solution for post-update battery drain is an overreaction, as it erases all user data and settings without first exploring more common and less destructive troubleshooting steps.

The update reset battery optimization settings; re-enable them.

Why it fails: While a system update could theoretically reset some battery optimization settings, it is not the most common or immediate cause of significant battery drain directly after an update. Android's power management features are generally robust and designed to persist across updates. Furthermore, even if some settings were altered, the primary reason for post-update drain is usually background system activity rather than a complete disablement of all optimizations, making re-enabling them an incomplete solution.

The battery is failing due to the update; replace the battery.

Why it fails: A software update, by its very nature, cannot physically damage the chemical components or internal circuitry of a lithium-ion battery. Battery degradation is a physical process related to charge cycles, age, and heat exposure, not software changes. Attributing a sudden battery failure directly to a software update is a misconception, as the update only modifies the operating system's instructions, not the hardware's physical integrity. Therefore, replacing the battery is an inappropriate and premature solution for post-update battery drain.

Certificates are easier to configure and manage than PSK.

Why it fails: While pre-shared keys (PSK) rely on a static shared secret that must be distributed and stored on each endpoint, certificate-based authentication uses a public-key infrastructure (PKI) to bind a device’s identity to a private key, eliminating the shared-secret vulnerability. This option is tempting because centralised certificate management can reduce manual key rotation overhead in large deployments, but the auditor’s concern is specifically the cryptographic weakness of PSK—not administrative convenience—so ease of configuration does not address the security gap.

Certificates eliminate the need for a VPN server.

Why it fails: Certificates serve as an authentication mechanism within a Virtual Private Network (VPN) solution, verifying the identity of clients or servers to ensure only authorized entities connect. However, they do not replace the fundamental role of a VPN server, which is responsible for establishing, managing, and terminating the encrypted tunnel, as well as routing traffic securely between the remote client and the internal network. The VPN server is a core component that certificates enhance, not eliminate.

Certificates are faster than PSK for establishing VPN connections.

Why it fails: Establishing VPN connections using certificates is generally slower than using pre-shared keys (PSK) due to the inherent computational overhead of asymmetric cryptography. Certificate-based authentication requires complex cryptographic operations, including public key decryption, signature verification, and often a certificate chain validation against a Certificate Authority. This process is significantly more resource-intensive and time-consuming than the simpler symmetric key comparison involved with a PSK.

Enable Guest Mode from the user switcher.

Why it fails: Guest Mode on Android creates a temporary, ephemeral user profile that is cleared upon exit, providing a clean slate for a temporary user. While it isolates the guest's data from the primary user, it does not inherently restrict the guest to a single application. A user in Guest Mode retains the ability to navigate the device's home screen, open various installed applications, and access system settings, which is contrary to the requirement of locking the device to a specific inventory app.

Set up a separate user account with restricted profile.

Why it fails: A restricted profile on Android allows an administrator to create a secondary user account with granular control over which applications are accessible. While this feature can prevent access to specific apps or content, it does not enforce a single-application lock. Users operating under a restricted profile can still switch between any of the applications explicitly permitted by the administrator, navigate the home screen, and potentially access certain limited settings, which fails to meet the requirement of confining the device to just the inventory application.

Activate Factory Reset Protection (FRP).

Why it fails: Factory Reset Protection (FRP) is a security feature designed to prevent unauthorized individuals from using a device after it has been factory reset. It requires the previous Google account credentials to be entered before the device can be set up and used again, effectively acting as an anti-theft measure. However, FRP has no bearing on the device's operational state or the applications accessible during normal, active use, and therefore offers no mechanism to restrict a user to a single inventory application.

Check if the router is using MAC address filtering.

Why it fails: MAC address filtering is a network security feature configured on the wireless access point or router, designed to permit or deny network access based on a device's unique hardware address. While it could prevent a phone from connecting, it's a less common configuration for general Wi-Fi networks and would typically affect *all* new devices unless specifically added. If other devices are connecting successfully, it's highly improbable that MAC filtering is the sole reason *this specific* Android phone cannot connect, making it a lower-priority troubleshooting step compared to client-side authentication issues.

Reset the phone's network settings to default.

Why it fails: Resetting the phone’s network settings clears saved Wi-Fi profiles, Bluetooth pairings, and VPN configurations, but it does not address authentication failures caused by mismatched corporate credentials, certificate trust issues, or an incorrect Extensible Authentication Protocol (EAP) method on the device. This step is tempting because it resolves many connectivity problems stemming from corrupted or conflicting network configurations, and would be correct if the phone had previously connected to a different network with incompatible settings that now interfere with the corporate SSID.

Update the phone's operating system to the latest version.

Why it fails: Updating the phone's operating system (OS) to the latest version, while beneficial for security patches and new features, is generally not the immediate first step for a basic Wi-Fi connection failure. While an extremely outdated OS *could* theoretically have compatibility issues with newer Wi-Fi standards or security protocols, it's a far less common cause than an incorrect password. Furthermore, an OS update can be time-consuming and may introduce new variables, making it an inappropriate initial diagnostic action for a simple authentication problem.

Pay the ransom to get the decryption key.

Why it fails: Paying the ransom is strongly discouraged because it provides no guarantee that a working decryption key will be provided, leaving the user's files still encrypted. Furthermore, it financially supports criminal organizations, encouraging them to perpetuate future attacks against other victims. This action does not resolve the underlying security vulnerability that allowed the ransomware to infect the system.

Run a full antivirus scan immediately.

Why it fails: Running a full antivirus scan immediately, while the PC remains connected to the network, is premature and potentially dangerous. The primary concern is that the active ransomware could continue to encrypt network shares or spread laterally to other systems before the scan completes or identifies the threat. Isolation of the infected machine must be the first step to contain the damage and prevent further compromise.

Restore files from a recent backup without disconnecting.

Why it fails: Restoring files from a recent backup without first disconnecting the PC from the network is highly risky and ineffective. If the ransomware process is still active on the system and the network connection remains, any restored files, especially those on network shares or cloud drives, could be immediately re-encrypted. The active threat must be neutralized and contained before attempting any restoration to ensure the integrity of the recovered data.

Virtual Private Network (VPN) with split tunneling.

Why it fails: A Virtual Private Network (VPN) primarily establishes an encrypted tunnel for network traffic, securing communication between the device and the corporate network. However, it does not provide granular management capabilities over the device itself, nor does it segregate corporate data from personal data on the endpoint. Split tunneling further compromises security by allowing non-corporate traffic to bypass the VPN, potentially exposing corporate data to unsecure networks without IT oversight or the ability to perform a selective wipe.

Remote Desktop Protocol (RDP) to a virtual desktop.

Why it fails: While Remote Desktop Protocol (RDP) to a virtual desktop centralizes corporate data on the server, preventing it from residing directly on the smartphone, it is not a comprehensive mobile device management solution. This approach does not manage the smartphone itself, enforce device-level security policies, or provide a unified experience for all corporate applications. Users would still likely access other corporate resources, such as email, directly on their mobile device, bypassing the virtual desktop and leaving corporate data unmanaged on the phone.

Third-party remote access software like LogMeIn.

Why it fails: Third-party remote access software, such as LogMeIn, is designed primarily for remotely controlling a desktop computer from another device, not for managing or securing corporate data on a mobile device itself. These tools lack the essential features of an MDM solution, including device enrollment, granular policy enforcement, application management, data containerization, or the ability to perform a selective wipe of corporate data on the mobile endpoint. They offer no control over the mobile device's security posture or the segregation of data.

The router's firmware is outdated.

Why it fails: Outdated firmware can indeed lead to various network instabilities, performance issues, or security vulnerabilities. However, the problem's sudden appearance immediately after a user-initiated change to the security mode strongly suggests a direct consequence of that configuration alteration, rather than a pre-existing or latent firmware bug. While a firmware update might be good general maintenance, it's not the most direct or probable cause for a connectivity failure specifically tied to a security mode change.

The devices do not support the new encryption cipher.

Why it fails: WPA2-Enterprise, like WPA2-Personal (PSK), primarily utilizes the Advanced Encryption Standard (AES) for data confidentiality, which is a widely adopted and supported encryption cipher across virtually all modern Wi-Fi devices. The issue is not with the encryption method itself, but rather with the underlying authentication mechanism. Devices are likely failing to establish a connection because they cannot complete the necessary authentication steps, not because they lack support for AES.

The SSID was changed during the configuration.

Why it fails: If the Service Set Identifier (SSID), or network name, had been changed, devices would simply no longer see the old network name and would need to be manually reconfigured to connect to the new SSID. However, the customer's description specifically states they changed the "security mode," implying the SSID remained the same. The problem is not that the network is invisible or renamed, but that devices cannot successfully authenticate to the existing network.

The phone's IMEI is blacklisted.

Why it fails: A blacklisted International Mobile Equipment Identity (IMEI) indicates that the device has been reported as lost, stolen, or involved in fraudulent activity. When an IMEI is blacklisted by a carrier or a central database, the network will typically deny all cellular services to that specific device, including voice calls, mobile data, and SMS. Therefore, if only SMS functionality is failing while other services like calls and data work, an IMEI blacklist is an unlikely cause.

The mobile data APN settings are incorrect.

Why it fails: Access Point Name (APN) settings are essential configurations that define how a mobile device connects to the internet and accesses multimedia messaging services (MMS) through the carrier's network. Incorrect APN settings would prevent the phone from accessing mobile data for web browsing, app usage, and sending/receiving MMS messages. However, basic Short Message Service (SMS) operates over the cellular control channel and does not rely on APN settings, so its failure would not be attributed to APN issues if data and calls are working.

The phone is in airplane mode.

Why it fails: When a phone is placed into airplane mode, it intentionally disables all wireless communication radios, including cellular (voice, SMS, data), Wi-Fi, and Bluetooth. This comprehensive shutdown is designed to prevent interference with aircraft systems and conserve battery. If the phone were in airplane mode, it would be unable to make or receive calls, access mobile data, or send/receive SMS messages, making it an unlikely cause if only SMS is failing while other cellular functions are operational.

The device's SD card is corrupted.

Why it fails: If an SD card were corrupted, the user would typically encounter specific error messages related to external storage access, such as "SD card unreadable" or "corrupted storage." An "insufficient storage" error during app installation almost always refers to the device's internal storage, where applications are primarily installed by default. Furthermore, simply deleting files from internal storage would not resolve a corruption issue on an external SD card, as corruption requires formatting or repair.

The app is incompatible with the Android version.

Why it fails: An application incompatible with the device's Android version would trigger a distinct error message during the installation attempt, such as "App not compatible with your device" or "This app requires a newer version of Android." The operating system performs compatibility checks before allowing the installation process to proceed. An "insufficient storage" error explicitly indicates a lack of available disk space, not a mismatch in software versions or hardware requirements.

The tablet's battery is too low to complete the installation.

Why it fails: While a critically low battery can indeed prevent various system operations, including app installations, the Android operating system is designed to provide specific warnings in such scenarios. A low battery condition would typically trigger a notification like "Low battery, connect charger" or "Installation paused due to low battery," rather than an "insufficient storage" error message. The error message directly points to a storage capacity issue, not a power supply problem.

Vishing

Why it fails: Vishing, a portmanteau of "voice" and "phishing," is a social engineering attack conducted exclusively over telephone calls. Attackers use deceptive voice messages or live conversations to trick individuals into divulging sensitive information, such as bank account details, credit card numbers, or login credentials, by impersonating legitimate entities. Since the user in the question clicked a link in a text message, rather than interacting via a voice call, vishing is not the correct term for this specific attack vector.

Pharming

Why it fails: Pharming is a cyberattack that redirects users from legitimate websites to fraudulent ones without their explicit knowledge or interaction, often by manipulating Domain Name System (DNS) resolution or modifying local host files. Unlike phishing, pharming does not require the user to click a malicious link in an email or text message; instead, the redirection occurs automatically when the user attempts to access a legitimate site. The scenario described, where the user actively clicked a link, indicates an explicit user interaction not characteristic of pharming's passive redirection.

Pretexting

Why it fails: Pretexting is a social engineering technique where an attacker creates a fabricated scenario, or "pretext," to manipulate a victim into divulging information or performing an action. This often involves impersonating someone in authority or a trusted individual to gain the victim's confidence through a convincing story, typically over the phone or in person. While a text message might be part of a broader pretexting scheme, the core of pretexting is the elaborate narrative and deception to extract information, whereas the question specifically highlights clicking a malicious link in a text message as the primary attack vector.

Disable SSID broadcast

Why it fails: Disabling the Service Set Identifier (SSID) broadcast merely hides the network's name from casual discovery by wireless clients. While it can deter very unsophisticated attackers, it does not prevent a determined individual from discovering the SSID through packet sniffers or other tools. Crucially, it provides no mechanism to restrict access to only authorized devices once the SSID is known, failing to meet the requirement for controlling which specific devices can connect.

Enable WPA3 encryption

Why it fails: Enabling Wi-Fi Protected Access 3 (WPA3) encryption secures the wireless communication channel by encrypting data transmitted between the access point and connected devices, and it provides robust authentication. However, WPA3's primary function is data confidentiality and integrity, along with stronger authentication protocols like Simultaneous Authentication of Equals (SAE). It does not inherently provide a mechanism to filter or restrict network access based on the unique Media Access Control (MAC) address of individual client devices.

Change the default admin password

Why it fails: Changing the default administrative password for the wireless router or access point is a fundamental security practice that protects the device's configuration interface from unauthorized access. This prevents malicious actors from altering network settings, including security protocols or access controls. However, securing the router's management interface does not, by itself, implement any control over which specific client devices are permitted to connect to the wireless network itself.

The file server requires a firmware update

Why it fails: While a firmware update for a file server might be performed during a maintenance window, it would typically be a planned and documented activity. If the update failed or caused an incompatibility, it could lead to issues. However, the prompt implies an undocumented or unexpected issue post-maintenance. Furthermore, a server merely 'requiring' a firmware update doesn't inherently prevent network connectivity unless the update process itself failed catastrophically or the server was taken offline for the update and not brought back up correctly, which would be a direct consequence of the maintenance, not just a general requirement.

The user’s account password has expired

Why it fails: An expired user account password would prevent the user from successfully authenticating to the file server and accessing shared resources, typically resulting in an 'access denied' or 'incorrect credentials' error message. However, the workstation would still be able to establish a network connection to the server's IP address or hostname. The problem statement indicates a complete inability to *connect*, which is a lower-level network issue, not an authentication failure.

The file server’s hard drive has failed

Why it fails: A hard drive failure on the file server would typically manifest as the server becoming unresponsive, failing to boot, or generating specific disk I/O errors in its event logs. While this would certainly prevent users from accessing files, it is a hardware fault that is generally unrelated to a scheduled maintenance window unless the maintenance involved physical server work that inadvertently caused the failure. Furthermore, the user's report of 'cannot connect' suggests a network-level issue rather than a server-level application or storage failure.