Information Security Program →mediumMultiple Choice

CISM Information Security Program Practice Question

Exhibit

Refer to the exhibit.
```
[Policy: BYOD]
Version: 2.0
Last Review: 2024-01-15
- Employees may connect personal devices to corporate network.
- Devices must be registered with MDM.
- All devices must have full disk encryption enabled
- Devices must run the latest OS version within 30 days of release.
- Containers for corporate data are required.
- Non-compliant devices will be blocked after 7 days grace period.
```

An auditor reviews the BYOD policy and notes that mobile device management (MDM) logs show several devices without encryption. The policy has been in effect for 6 months. Which of the following is the most likely reason for this non-compliance?

⚠ Common exam trap

Many exam-takers assume the policy itself is flawed (option C) or that user awareness is the root cause (option B), but the question specifically highlights MDM logs showing non-compliance, pointing to a technical enforcement gap rather than a policy or awareness issue.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

MDM is not configured to enforce encryption automatically

MDM systems can enforce encryption policies automatically by requiring devices to comply before granting access to corporate resources. If the MDM is not configured to enforce encryption, devices will remain non-compliant even if the policy requires encryption. The logs showing several devices without encryption after six months strongly indicate that the MDM is not actively enforcing the encryption requirement, making D the most likely reason.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The grace period allows non-compliance for 7 days
Why it's wrong here
A seven-day grace period cannot explain devices still unencrypted six months after the policy took effect; that window expired long ago. It is tempting because grace periods do legitimately permit temporary non-compliance during initial rollout, which would be the answer had the policy been introduced only days before the audit.
✗
Employees are unaware of the encryption requirement
Why it's wrong here
Policy is documented; likely awareness exists.
✗
The policy does not explicitly require encryption
Why it's wrong here
MDM logs show devices lacking encryption despite an enforced policy, so the control exists but is not applied; the likely cause is technical, such as devices failing compliance checks or MDM profiles not enforcing encryption. A policy omitting encryption would produce no encryption requirement at all, not logged non-compliance against one.
✓
MDM is not configured to enforce encryption automatically
Why this is correct
Unenforced MDM configuration leaves encryption as a manual user action, so devices lacking it remain non-compliant despite the six-month-old policy. Compliance requires the MDM profile to mandate encryption at enrolment; without that technical control, policy alone cannot satisfy the requirement.

Go deeper

CISM Information Security Program Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question