CAS-003 · Question #650
Several days after deploying an MDM for smartphone control, an organization began noticing anomalous behavior across the enterprise Security analysts observed the following: - Unauthorized…
The correct answer is B. A managed mobile device is rooted exposing its keystore and the MDM should be reconfigured to. The most likely root cause is that a managed mobile device was rooted. When a device is rooted, the Android (or iOS) keystore - which securely stores certificates and private keys pushed by the MDM - is exposed. An attacker with access to a rooted device can extract the device…
Question
Several days after deploying an MDM for smartphone control, an organization began noticing anomalous behavior across the enterprise Security analysts observed the following:
- Unauthorized certificate issuance
- Access to mutually authenticated resources utilizing valid but unauthorized certificates
- Granted access to internal resources via the SSL VPN
To address the immediate problem security analysts revoked the erroneous certificates. Which of the following describes the MOST likely root cause of the problem and offers a solution?
Options
- AThe VPN and web resources are configured with too weak a cipher suite and should be rekeyed
- BA managed mobile device is rooted exposing its keystore and the MDM should be reconfigured to
- CSCEP is configured insecurely which should be enabled for device onboarding against a PKI for
- DThe CA is configured to sign any received CSR from mobile users and should be reconfigured to
How the community answered
(31 responses)- A6% (2)
- B58% (18)
- C13% (4)
- D23% (7)
Explanation
The most likely root cause is that a managed mobile device was rooted. When a device is rooted, the Android (or iOS) keystore - which securely stores certificates and private keys pushed by the MDM - is exposed. An attacker with access to a rooted device can extract the device certificates and use them to authenticate against resources that use mutual TLS, including the SSL VPN. This explains why valid but unauthorized certificates were used: they were legitimate certificates extracted from a compromised keystore. The solution is to reconfigure the MDM to detect rooted/jailbroken devices and revoke or block their access. Option D (CA signing any CSR) would be a misconfiguration in certificate issuance, but the problem described involves using already-issued certificates, not forging new ones through an open CA. SCEP misconfiguration (C) could allow unauthorized enrollment but doesn't explain compromised keystore access.
Topics
Community Discussion
No community discussion yet for this question.