CISA Question 125

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  A Bring Your Own Device (BYOD) strategy introduces significant security risks, such as: Unsecured personal devices accessing corporate data, Lack of consistent controls over all endpoints, Potential for data leakage or loss. The BEST way to initially address these risks is through a mobile device awareness program, which: Educates users on security policies and acceptable use, Raises awareness about risks like phishing, unsecured networks, and unauthorized apps, Reinforces behaviors that protect organizational data on personal devices. Without user understanding and compliance, technical controls can be undermined. Why not the others? A. Mobile device testing program ➤ Useful for technical validation, but doesn’t address human behavior and awareness—key in BYOD contexts. B. Mobile device upgrade program ➤ Helps keep software and hardware secure, but not sufficient on its own. D. Mobile device tracking program ➤ Helpful for locating lost devices, but doesn’t mitigate most security risks BYOD introduces.

• Chose C1

  This educates employees on the organization's BYOD policies, security practices, and potential risks, ensuring they understand their responsibilities in maintaining the security of their personal devices when accessing corporate resources. Effective awareness programs can significantly reduce the likelihood of security incidents caused by employee negligence or lack of understanding, such as downloading malicious apps, connecting to insecure networks, or mishandling sensitive data.

• Chose A3

  Answer: A First test the device compliance with ORG BOYD Policy and ORG Security Policy