mediumMultiple Choice
BYOD Data Protection: Why Remote Wipe Is Most Important for Lost Devices
An organization allows employees to use personal smartphones to access corporate email and data. Which control is MOST important to protect corporate data if a device is lost or stolen?
Quick Answer
Remote wipe capability is the most important control for a lost or stolen BYOD device because it's the only option among the alternatives that can act after the device is already out of the organization's physical control, directly removing the corporate data rather than merely trying to keep an attacker from reaching it in the first place. Device encryption protects data at rest, but that protection only holds while the device stays locked; if the device is unlocked when lost, or an attacker eventually bypasses the lock, encryption alone does nothing further to stop data exposure. Strong passwords raise the difficulty of unauthorized access, but they aren't unbreakable, since they can potentially be defeated through brute-force guessing or social engineering, and once bypassed, all the data on the device is exposed with no further layer of defense. A screen lock timeout only buys a small delay before the device locks itself; it doesn't prevent extraction of data once someone has gained access, and it does nothing at all if the device was already unlocked at the moment it was lost. Remote wipe is different because it doesn't try to prevent access; it responds to the loss event itself by actively erasing the corporate data from the device, regardless of whether the device is locked, unlocked, or already compromised. When a question asks for the MOST important control specifically for a lost-or-stolen scenario, prioritize the control that acts after the loss occurs over controls that only work as long as the device stays in the user's possession.
⚠ Common exam trap
SSCP often tests the difference between preventive and corrective controls; candidates may choose encryption or strong passwords as they are preventive, but the question asks for the MOST important control when a device is already lost or stolen, which requires a corrective control like remote wipe.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement remote wipe capability
Remote wipe capability is the most important control because it allows the organization to remotely erase corporate data from a lost or stolen device, directly mitigating the risk of unauthorized access. While encryption, strong passwords, and screen locks provide defense-in-depth, they do not guarantee data destruction if the device falls into the wrong hands. Remote wipe is the only control that ensures corporate data is removed from the device, addressing the specific threat of loss or theft.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require device encryption
Why it's wrong here
Encryption protects data at rest, but a powered-on lost device with an active session exposes email through the unlocked client. It is tempting because full-disk encryption is the standard answer for stolen laptops, where the attacker must defeat the boot credential before reading storage.
- ✗
Require strong passwords with complexity requirements
Why it's wrong here
A complex passcode only gates the lock screen; without a short timeout the device stays unlocked and email remains readable. It is tempting because password complexity is a foundational authentication control, and it would be the right choice when the threat is brute-force guessing of stored credentials.
- ✓
Implement remote wipe capability
Why this is correct
Remote wipe lets administrators erase corporate email and data from a lost or stolen personal smartphone, addressing the BYOD confidentiality risk directly. It satisfies the stem's requirement to protect corporate data when the device is outside organisational physical control.
- ✗
Enforce a screen lock timeout of 1 minute
Why it's wrong here
A one-minute timeout reduces the unlocked window but cannot erase data already cached on the handset, and it is trivially extended by the user. It is tempting because screen-lock timeouts are the classic mitigation for unattended-device shoulder surfing in an office, not for physical theft.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A BYOD policy allows personal devices to access corporate email. What is the best control to enforce device encryption and remote wipe?
hard- A.Network Access Control (NAC)
- ✓ B.Mobile Device Management (MDM) profile
- C.Containerization app
- D.Mandatory VPN connection
Why B: An MDM profile pushes configuration and policy to enrolled personal devices, including enforced storage encryption, screen-lock requirements, and the ability to issue a remote wipe of corporate data. It is the standard control for BYOD because it operates at the OS management layer regardless of the network path.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.