You are the mobile security administrator for an organization that supports a BYOD environment. After rolling out SES Complete to employee smartphones, your team receives alerts about several devices connecting to high-risk Wi-Fi networks while traveling.
What steps should you take to mitigate the risk while maintaining productivity? (Choose three)

• A. Notify users and request confirmation before performing policy enforcement
• B. Use the ICDm dashboard to verify the alert origin and associated threat level
• C. Configure policy updates to disable the Wi-Fi feature on all affected devices
• D. Enable automatic isolation of network traffic for compromised devices
• E. Analyze behavior patterns for recurring risky locations and update geofencing rules

What benefit does ICDm provide when managing remote endpoints?

• A. Limits endpoint visibility outside the LAN
• B. Blocks updates unless the device is on-premises
• C. Enables real-time policy enforcement and threat remediation
• D. Requires VPN to update policies

What is the primary purpose of the Incident Lifecycle feature in ICDm?

• A. To provide a structured method for tracking threat detection and response stages
• B. To automate the export of forensic data to external SIEMs
• C. To schedule monthly reports for incident metrics
• D. To map threats to known vulnerabilities based on MITRE ATT&CK

What condition must be met to successfully enable Application Control within the ICDm console to begin implementing attack surface reduction policies?

• A. Admin roles must be set to "Audit Mode" for App Control.
• B. All endpoints must have Intel TPM 2.0 enabled.
• C. Endpoints must be connected to the internal network via Ethernet.
• D. A valid policy group must be selected for deployment.

What can administrators do to remediate threats using ICDm? (Choose two)

• A. Isolate the endpoint from the network
• B. Rewrite the group policy
• C. Terminate a malicious process
• D. Delete endpoint agents remotely