Question

A SOC analyst receives an alert that a corporate-managed Android smartphone belonging to an executive has begun beaconing to an unfamiliar external IP address every few minutes. The device is enrolled in the organization's Mobile Device Management (MDM) platform and contains sensitive email and files. The executive is currently traveling internationally and is using the device. What is the BEST first investigative step to take?

Accepted Answer

Query the MDM console for the device's installed application inventory, OS/patch level, and compliance status to identify anomalous or sideloaded apps

Answer

Immediately issue a remote wipe command through the MDM to eliminate any potential malware on the device

Answer

Block the executive's user account in Active Directory to stop any further data access

Answer

Physically seize the device for forensic imaging when the executive returns from travel