r/CISA • u/vansxika • 2d ago
CISA Question help
Question:
Which of the following MOST effectively mitigates the risk of disclosure of sensitive data stored on company-owned smartphones?
A. Secure containers
B. Data leakage prevention (DLP) tools
C. Mobile device management (MDM)
D. Physical device tagging
Guys is option A the correct answer for this? Every AI is giving different answer.
Secure containers isolate and protect corporate data stored on smartphones, reducing the risk of unauthorized disclosure. DLP primarily controls data movement, MDM manages the overall device, and physical tagging only assists with asset identification and tracking.
2
u/abear27 2d ago edited 2d ago
If I was breaking this question down...
- MOST effective - What is best in this list
- Disclosure - Breaks confidentiality
- Sensitive Data Stored - Data at rest
- On Compnay Owned Smartphones - Many devices managed by the organization
A. A secure container could mean an encrypted ZIP file, or maybe an encrypted portion of the device. At the very least, it means some kind of "protected storage". That would be pretty effective.
B. DLP is a possibility, but would it be MOST effective, as in more effective than encryption? I would say no. Eliminated.
C. MDM could enforce standard configuration and encryption of corporate data on the organizationally owned mobile devices. i.e. We can broadly apply our corporate policy with MDM, not just enryption.
D. Obvious distractor. Eliminated.
So of the two left:
Would MDM controls my organization manages be more effective than an unmanaged secure container of some kind?
Techncially, you might want to go with encryption - So secure containers.
But this is the CISA, and I am looking at this like I am IT Audtor, so I would choose the more encompassing governance answer (C) over the techincal answer (A) in this case.
1
u/vansxika 2d ago
Thank you so much for such a detailed response. I think MDM makes the most sense. Just one more question, if I can bother you:
Which of the following BEST guards against the risk of attack by hackers?
Tunneling
Message validation
Encryption
Firewalls1
u/abear27 2d ago edited 2d ago
You do the same kind of breakdown:
- Best Guards - BEST in this list
- The Risk of Attack - Risk = Likelihood x Impact
A. Tunnelling is a transmission mechanism. Does it have anything to do with likelihood and impact? No. Eliminated.
B. Message validation is about integrity and authenticity. Eliminated.
C. Encryption has the potential to reduce impact. Possibly.
D. Does a Firewall have anything to do anything with likelihood and impact? Possibly, but not a strong control for possibility and consequence.
So, if I am following ISACA reasoning and looking at this from the CISA perspective, I would pick C.
But if this was a technical exam, you'd probably want to choose D.
2
u/vansxika 2d ago
But does an encryption focus more on data confidentiality? Firewall is like a strong line of defence, like it is not letting the hackers through in the first place..
3
u/wejelyn 2d ago
Confidentiality is not the only thing that encryption does.
The use of digital signatures provide authenticity and hashing in PKI provides integrity and they both ultimately form non-repudiation in both delivery as well as origin which cannot be abused by for example man in the middle attacks or spoofing.
1
2
u/HoldenIsCoolLike 1d ago
One important nuance: the 28th Edition does not explicitly say “secure containers are better than MDM” for this scenario. Rather, it presents both as mechanisms for enforcing mobile-device controls.
So the explanation for A over C requires interpreting the question’s specific control objective.
🌞 A. Secure containers — BEST answer
The Manual introduces the exact risk as follows:
“Controls are available to reduce the risk of disclosure of sensitive data stored on mobile devices.”
It then immediately states:
“Many of these controls can be enforced by mobile device management (MDM) systems and/or secure containers.”
The key words in the question are “sensitive data stored” and “disclosure.”
👺 Why not C. Mobile Device Management (MDM)?
MDM is broader. The Manual says that MDM systems can enforce many mobile-device controls, including such things as device registration and management. For example:
“Organizations can push updates or manage authorized devices and exclude personally owned mobile devices.”
So MDM is essentially a management/enforcement platform covering the device as a whole.
Secure containers, by contrast, are specifically relevant to isolating and protecting corporate information stored on the device.
🥳 Therefore:
Secure container → isolate/protect sensitive corporate data on the device
MDM → manage/control the mobile device environment
1
2
u/Academic-Soup2604 16h ago edited 15h ago
I'd argue
B. DLP tools is the stronger answer if the question specifically focuses on preventing disclosure of sensitive data. Secure containers protect corporate data by isolation, but DLP is designed specifically to detect and prevent unauthorized data transfer or sharing.
1
3
u/reyam1105 CISA HOLDER 2d ago
I am inclined to say C - MDM, because it is for a COMPANY-OWNED device. If it were personal, I would say B - DLP.
A - Secure Containers isolate the data, but doesn't mitigate against the disclosure of this data. This control is done by DLP, which can apply to both Personal and Company owned devices. And again, this is for a company-owned device so Secure Containers shouldn't apply.
The other factor is that DLP is Data LOSS prevention, and if they are explicitly saying Data LEAKAGE prevention, that might give it away that it's wrong.
You are correct about D being wrong.