Carlos is the Information Technology (IT) administrator for a small company. Over the past year, employees have been using their personal mobile devices and smartphones for business use. This has…

The correct answer is C. Create a policy that specifies acceptable use, ensuring security measures are in place for mobile. Option C is correct because the core challenge with BYOD (Bring Your Own Device) is that a single policy establishing acceptable use and mandating security measures - such as encryption, remote wipe capability, and MDM enrollment - is the only approach that addresses the full…

Network Security

Question

Carlos is the Information Technology (IT) administrator for a small company. Over the past year, employees have been using their personal mobile devices and smartphones for business use. This has reduced costs of purchasing new devices for employees. Carlos is now considering whether he should stop supplying employees with company phones and instead require all employees to use their personal smartphones for work. How can Carlos address the most significant security vulnerability?

Options

ADevelop a robust app to push security updates out to the various mobile OS devices
BCreate an employee policy that requires employees to keep phones updated to the latest
CCreate a policy that specifies acceptable use, ensuring security measures are in place for mobile
DMandate that employees switch to the company's mobile service provider to ensure security

How the community answered

(56 responses)

A
7% (4)
B
4% (2)
C
73% (41)
D
16% (9)

Explanation

Option C is correct because the core challenge with BYOD (Bring Your Own Device) is that a single policy establishing acceptable use and mandating security measures - such as encryption, remote wipe capability, and MDM enrollment - is the only approach that addresses the full scope of risks across a diverse mix of personal devices and operating systems.

A is wrong because Carlos cannot realistically develop or push security updates to personally owned devices running different OSes (iOS, Android, etc.); he doesn't control those platforms.
B is wrong because an update policy alone is too narrow - it only addresses patching, ignoring data handling, access controls, lost-device procedures, and other vulnerabilities inherent to BYOD.
D is wrong because switching carriers does not address security; carrier choice has no meaningful impact on device security posture or data protection.

Memory tip: Think "BYOD = policy first." Whenever a question involves personal devices in a corporate context, the answer almost always centers on a comprehensive Acceptable Use Policy (AUP) - it's the administrative control that governs everything else.

Topics

#BYOD#Mobile Security#Security Policy#Acceptable Use

Community Discussion

Ingrid P.May 31, 2026

C is correct. A blanket acceptable-use policy is the right lever here because it addresses the full surface area of the BYOD risk, covering device encryption, passcode requirements, remote wipe consent, and app restrictions, rather than patching one narrow gap like update cadence or carrier choice.

Samuel O.Jun 8, 2026

My first instinct was B because in my experience half the security incidents I've seen came down to somebody running a two-year-old OS with known exploits sitting wide open, so keeping devices patched feels urgent and concrete. But the more I thought about it, a policy that just says "stay updated" does nothing about data handling, app permissions, network usage, or what happens when that personal device gets lost or sold, and that is where BYOD really bites you. Option C wins because a proper acceptable use policy is the umbrella that covers all of it, including the update requirement, and it gives Carlos something enforceable when an employee decides to back up corporate email to a sketchy third-party cloud app. A is a nice idea on paper but pushing updates to devices the company does not own and control across a dozen different Android versions and iOS builds is a nightmare that will fall apart fast in a small shop with no MDM budget.

Dervla O.May 15, 2026

The most significant vulnerability in a full BYOD rollout is not patching lag or carrier choice, it is the total absence of a governance framework that defines what the device must have before it ever touches company data. Before you memorize C as the answer, think about why A and B each fail to address the broader problem even if they sound reasonable on the surface. What do you think is the one thing a policy like C must include that neither A nor B can substitute for, even if implemented perfectly?

Ingrid P.May 17, 2026

Dervla is right that governance is the load-bearing structure, but the one thing C must include that A and B cannot substitute for is a mandatory enrollment baseline, meaning the device is blocked from data access entirely until it passes a compliance check, because patching cadences and carrier vetting both assume the device is already in scope.

Mei-Ling H.Jun 13, 2026

C is right, but why is a policy better than pushing updates directly?

Ingrid P.Jun 16, 2026

Policy enforces the setting persistently on every affected machine at every refresh interval, so you are not one forgotten endpoint away from a drift that breaks your audit trail.

Full 1D0-61C Practice