An organization deploys MDM-managed Android devices to field staff. The IT policy specifies a maximum screen lock timeout of 30 seconds. Staff complain the timeout is too aggressive during active work sessions and request it be raised to 10 minutes.
Which security risk directly increases if the screen lock timeout is raised from 30 seconds to 10 minutes in this scenario?
- A.A. Brute-force attacks on the device PIN become more likely because more unlock attempts occur
- B.C. Encryption keys stored in the Android Keystore are more likely to be exported during the longer idle window
- C.B. An unattended unlocked device is accessible to a physical threat actor for up to 10 minutes without credential entry
- D.D. MDM profile integrity checks run less frequently, allowing policy drift
Why C is correct
Screen lock timeout directly controls the window during which a physically present attacker can access the device without credentials. A 30-second timeout gives an opportunist attacker a very small window; 10 minutes gives them a far larger window to exfiltrate data, install malware, or read messages. PIN brute-force is unrelated to timeout (brute-force protection is handled by attempt limits and wipe-after-N-failures). Android Keystore keys are hardware-backed and not exportable regardless of screen state. MDM profile checks are server-driven and independent of timeout settings.
Know someone studying for Mobile Security Fundamentals? Send them this one.