Mobile, BYOD, and MDM

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Mobile, BYOD, and MDM

Key Takeaways Explain This Topic AI

Mobile security balances business access with device posture, data protection, user privacy, and usability across deployment models.

Know the deployment models on SY0-701: BYOD, COPE (corporate-owned, personally enabled), COBO, and CYOD, plus their privacy tradeoffs.

MDM/UEM enforces encryption, screen locks, app control, compliance posture, and selective remote wipe of the work container.

Containerization separates managed business data from personal data, enabling work-profile wipe without erasing personal content.

Lost-device response prioritizes remote lock or selective wipe, token/session revocation, and conditional-access review.

Last updated: June 2026

Mobile Devices Are Endpoints That Leave the Building

Mobile devices connect to untrusted networks, run user-installed apps, and store business data, so they are endpoints that need both policy and technical controls. SY0-701 tests the deployment models because each one shifts the privacy and control balance.

• Model Ownership Control / privacy tradeoff
• BYOD Employee owns the device Lowest cost, highest privacy concern; needs containerization

COPE (corporate-owned, personally enabled) Company owns, personal use allowed Strong control with some personal use

• CYOD (choose your own device) Company-approved list, often company-owned Balance of choice and control
• COBO (corporate-owned, business only) Company owns, business only Maximum control, no personal use
• MDM and UEM Controls

Mobile Device Management (MDM) , increasingly delivered as Unified Endpoint Management (UEM) , enforces configuration and inventory across the fleet.

• Control Purpose
• MDM / UEM enrollment Enforce settings and manage device inventory
• Screen lock + biometrics Reduce access after loss or theft
• Device encryption Protect data at rest
• Selective remote wipe Erase the managed work container, not personal data
• App allow list / block list Control which apps may run or access work data
• Containerization / work profile Separate business data from personal photos and messages
• Compliance posture check Validate OS version, encryption, and jailbreak/root status
• Per-app VPN Tunnel only selected business app traffic
• Conditional access Grant access only to compliant, posture-checked devices
• BYOD Policy Must Cover

Enrollment : which personal devices may reach business resources.

Privacy : exactly what IT can and cannot see on a personal device.

Data ownership : business data is separated and remains the company's.

Offboarding : revoke access and wipe the work profile when the need ends.

Lost-device reporting : fast reporting expectations and response steps.

Worked Scenario

A salesperson uses a personal phone for company email and customer documents. A sound BYOD design enrolls the device in MDM, installs a managed work profile, requires encryption and a minimum OS version, enforces a screen lock, enables selective wipe of the work container, applies conditional access keyed to compliance, and documents the privacy terms the user consents to.

When that employee resigns, the response is to revoke OAuth tokens and active sessions, selectively wipe the managed work profile, and confirm that shared files and SaaS apps no longer grant access. Personal photos and texts remain untouched, which is exactly why containerization matters.

Common Exam Traps

Trap answer Better reasoning

"BYOD lets IT wipe the whole device anytime." BYOD needs documented consent and selective (work-only) wipe.

"A PIN is enough after a device is lost." Also revoke sessions/tokens and remote lock or selectively wipe.

"Jailbreaking just adds customization." It bypasses platform controls; compliance policy should block access.

"All traffic must use a full-device VPN." Per-app VPN protects business apps with less impact on personal traffic.

Mobile-Specific Threats the Exam Tests

Objective 2.4 and the operations domain both reference mobile attack vectors, so connect each threat to a control.

• Threat Description Control
• Sideloading Installing apps outside the official store Block sideloading via MDM; app allow-list
• Jailbreak / root Removing vendor restrictions Compliance check denies access

Bluejacking / bluesnarfing Unsolicited messages / data theft over Bluetooth Disable discoverable mode; patch; limit pairing

• Rogue access point / evil twin Fake Wi-Fi captures traffic VPN, certificate validation, avoid auto-join
• SIM swapping Hijacking the phone number to defeat SMS MFA Prefer app-based or hardware MFA over SMS
• Connection Methods and Their Risk

Mobile devices connect over cellular, Wi-Fi, Bluetooth, NFC, and GPS , and each carries operations implications. Open or public Wi-Fi is a man-in-the-middle risk that TLS and a VPN mitigate. NFC powers tap-to-pay but has a very short range, limiting (not eliminating) interception. GPS enables geolocation and geofencing , which MDM can use to enforce policy by location, for example wiping or locking a device that leaves an approved region. Tethering and personal hotspots can bypass corporate egress controls, so policy should govern them.

Provisioning, Deprovisioning, and Carrier Considerations

Lifecycle management is a frequently tested operations theme. Provisioning pushes the baseline configuration, certificates, and managed apps at enrollment. Deprovisioning must reliably remove corporate data, certificates, and access on offboarding or device retirement. For corporate-owned fleets, track the carrier unlocking state and ensure devices are wiped before reassignment or disposal so no business data or saved credentials survive.

Application and Content Management

Beyond the device, MDM/UEM manages the apps and data on it. Mobile application management (MAM) controls only the managed apps and their data, which is ideal for BYOD because it avoids touching the personal side of the device. Mobile content management (MCM) governs how documents are stored, opened, and shared, often forbidding copy-paste or "open in" actions that would move a corporate file into an unmanaged personal app. Pair these with data loss prevention (DLP) policies so a customer list cannot be backed up to a personal cloud account.

On the exam, when a question asks how to stop work data from leaking into personal apps on a BYOD phone, the answer set centers on MAM, MCM, containerization, and DLP rather than a full-device wipe, which would be disproportionate and raise privacy concerns.