Study guide · 7.1
Manage device security
Managing device security goes beyond a strong password. Multifactor authentication, regular malware scanning and safe handling of devices when they change hands protect both your data and the people who use the device next.
A study feature written by ExamDragon, not part of the real exam. Each heading is one of Certiport's skills for this objective.
7.1.1Explain multifactor authentication concepts
- Authentication factors fall into three types: something you know (password, PIN), something you have (phone, security key) and something you are (fingerprint, face).
- Multifactor authentication (MFA) requires two or more different types, so a stolen password alone is not enough to sign in.
- Common second factors include authenticator app codes, push approvals, hardware security keys and text message codes, which are the weakest of these.
- Passkeys combine a device you have with a PIN or biometric and resist phishing well.
- Never approve a sign-in request you did not start, and store backup recovery codes somewhere safe.
Example: An attacker steals a staff member's password in a phishing email, but cannot sign in because the account also requires a code from the authenticator app on her phone.
7.1.2Explain virus-scanning concepts
- Antivirus or anti-malware software detects, blocks and removes harmful software such as viruses, ransomware and spyware.
- Real-time protection checks files as they are opened or downloaded; on-demand or scheduled scans check the whole system or chosen files.
- Signature-based detection matches known malware; behaviour-based (heuristic) detection spots suspicious actions from new threats.
- Keep the software and its threat definitions updated, and scan USB drives and downloads before opening them.
- Suspicious files are usually quarantined, isolated so they cannot run, so you can delete or restore them; a harmless file can occasionally be flagged by mistake (a false positive).
Example: A full scan finds a malicious browser extension; the antivirus quarantines it, and the user removes the extension and changes passwords that were used in that browser.
7.1.3Manage the transfer of hardware to others
- Back up your files first, and check that the backup opens.
- Sign out of accounts, deauthorise licensed apps and turn off device-tracking or activation lock features so the next owner can set it up.
- Remove SIM and memory cards, and unpair the device from your other accounts and accessories.
- Erase the device with a factory reset; with encryption turned on, the reset makes the old data unreadable.
- In a workplace, return devices through IT, which may need to remove them from management and wipe them to a set standard; very sensitive storage may need certified erasure or physical destruction.
Example: Before selling an old phone, a user backs it up to the cloud, signs out of the app store account, turns off the find-my-phone feature, removes the SIM card and performs a factory reset.
Key terms
- Multifactor authentication (MFA)
- Signing in with two or more different types of proof of identity.
- Authenticator app
- An app that generates short-lived sign-in codes or approves sign-ins.
- Malware
- Any software designed to harm, spy on or take control of a device.
- Quarantine
- Isolating a suspicious file so it cannot run or spread.
- Factory reset
- Restoring a device to its original settings and erasing user data.
- Encryption
- Scrambling data so only someone with the right key can read it.
Easy to confuse
- Two passwords, or a password and a security question, are both 'something you know', so they are not true multifactor authentication.
- Simply deleting files or emptying the recycle bin does not securely erase them.
- An antivirus program does not replace updates, backups and careful behaviour.
After this guide: You can explain MFA and virus scanning and prepare a device safely before passing it to someone else.