Information Security Program →mediumMultiple ChoiceObjective-mapped

CISM Information Security Program Practice Question

Exhibit

Refer to the exhibit.
```
[Policy: BYOD]
Version: 2.0
Last Review: 2024-01-15
- Employees may connect personal devices to corporate network.
- Devices must be registered with MDM.
- All devices must have full disk encryption enabled
- Devices must run the latest OS version within 30 days of release.
- Containers for corporate data are required.
- Non-compliant devices will be blocked after 7 days grace period.
```

An auditor reviews the BYOD policy and notes that mobile device management (MDM) logs show several devices without encryption. The policy has been in effect for 6 months. Which of the following is the most likely reason for this non-compliance?

⚠ Common exam trap

Many exam-takers assume the policy itself is flawed (option C) or that user awareness is the root cause (option B), but the question specifically highlights MDM logs showing non-compliance, pointing to a technical enforcement gap rather than a policy or awareness issue.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

MDM is not configured to enforce encryption automatically

MDM systems can enforce encryption policies automatically by requiring devices to comply before granting access to corporate resources. If the MDM is not configured to enforce encryption, devices will remain non-compliant even if the policy requires encryption. The logs showing several devices without encryption after six months strongly indicate that the MDM is not actively enforcing the encryption requirement, making D the most likely reason.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The grace period allows non-compliance for 7 days
Why it's wrong here
Grace period is for OS updates, not encryption.
✗
Employees are unaware of the encryption requirement
Why it's wrong here
Policy is documented; likely awareness exists.
✗
The policy does not explicitly require encryption
Why it's wrong here
The policy clearly requires full disk encryption.
✓
MDM is not configured to enforce encryption automatically
Why this is correct
Without automated enforcement, compliance is voluntary.

Go deeper

CISM Information Security Program Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question