Building inspectors tether GIS map updates over personal 5G hotspots with no mobile device management and no split-tunnel policy for city applications. Which control set best addresses the cellular and mobile network risk?
Select an answer to reveal the explanation.
Short Explanation
A random hotspot is basically a coffee-shop network in your pocket. Without MDM and a tunnel policy, those GIS updates wander across whoever’s RAN you’re on. Manage the device, prefer approved cellular paths, and keep city apps inside an encrypted, controlled tunnel.
Full Explanation
Building inspectors moving GIS updates over unmanaged personal hotspots expose municipal mapping and field data to whoever controls that radio path and whatever malware sits on the unmanaged handset. MDM enrollment establishes inventory, configuration, and policy reach to the device itself. Preferring managed cellular or approved hotspots reduces unknown intermediary risk. VPN or per-app tunneling forces GIS and other city applications through encrypted, policy-controlled channels instead of raw split-tunnel browsing that can leak sessions, credentials, and geospatial updates across consumer RAN paths. Together these controls restore identity, encryption, and administrative oversight that personal tethering strips away.
Banning all cellular use and forcing a return to LAN desktops ignores legitimate field workflows and often drives shadow IT that is even less controlled; secure design enables mobile work under policy rather than pretending inspectors never leave the office. Allowing unmanaged hotspots because DNS uses a public resolver confuses name resolution with end-to-end city identity—carriers do not authenticate municipal apps or encrypt GIS payloads to city standards. Publishing the GIS database on an open cellular APN removes access friction for attackers as well as inspectors and substitutes exposure for latency management.
Exam caveat: CISSP mobile and network topics stress managed endpoints, encrypted tunnels, and least exposure of sensitive apps on untrusted networks. Carrier trust and DNS choices are not substitutes for organization-controlled MDM and VPN policy.
Operational check: verify inspection devices appear in MDM with compliance gates; confirm GIS apps use forced tunnel or per-app VPN with split-tunnel exceptions documented and justified; block unmanaged hotspots from receiving production credentials; and sample field sessions to ensure map updates terminate on authorized city endpoints rather than cleartext over consumer paths.