An organization, which handles large volumes of PII, allows mobile devices that can process, store, and transmit PII and other sensitive data to be issued to employees. Security assessors can…

Question

Options

• AImplement a container that wraps PII data and stores keying material directly in the container's
• BUse encryption keys for sensitive data stored in an eF use-backed memory space that is blown
• CIssue devices that employ a stronger algorithm for the authentication of sensitive data stored on
• DProcure devices that remove the bootloader binaries upon receipt of an MDM-issued remote wipe

• A
  66% (23)
• B
  9% (3)
• C
  20% (7)
• D
  6% (2)

Explanation

The root problem is that a standard MDM wipe does not cryptographically destroy the data - remnants remain recoverable. Option A implements a data container where PII is encrypted and the encryption key material is managed at the container level; when the MDM wipe command is issued, the keys are destroyed, rendering the encrypted data unrecoverable even if physical remnants exist. Option B (eFuse-blown memory) is technically compelling but eFuse destruction is a hardware-permanent action, not practical for routine MDM wipes and may not cover all data locations. Option C (stronger authentication algorithm) protects access but not residual data. Option D (removing bootloader on wipe) affects device bootability but does not cryptographically erase sensitive stored data. Container-based encryption with centrally managed keys is the most practical and complete solution.

No community discussion yet for this question.