Mobile Attack Vectors and OWASP Mobile Top 10 CEH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company allows employees to use personal smartphones for work email and calendar. The security team wants to reduce the risk of data leakage from malicious apps that request excessive permissions. Which approach best balances user privacy and corporate data protection?

   • ABlock all personal app installations on employee devices
   • BRequire employees to install a third-party antivirus app on each personal device
   • CAsk employees to manually review app permissions each week
   • DEnroll devices in an MDM and use containerization to separate corporate data from personal apps
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is implementing a BYOD policy and must balance employee privacy with corporate security. The security team wants to enforce a minimum OS version, require a passcode, and be able to remotely wipe corporate data. Which MDM approach best meets these requirements while respecting employee privacy?

   • AUse a device-level MDM profile that can see all apps and data
   • BUse a containerized MDM profile that only manages corporate apps and data
   • CUse a VPN to encrypt all traffic on the device
   • DRequire employees to use a separate work phone
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is assessing the risk of a mobile app that uses a third-party SDK for analytics. The SDK is known to collect device identifiers and location data. The team must decide whether to keep the SDK. Which consideration is most critical from a mobile attack vector perspective?

   • AThe SDK's data collection permissions and whether they exceed the app's functional needs
   • BThe SDK's cost and licensing model
   • CThe SDK's user interface design
   • DThe SDK's popularity among other apps
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company allows employees to bring their own devices (BYOD) to access corporate email. The security team wants to prevent corporate data from being leaked through malicious apps that request excessive permissions. Which combination of measures would best mitigate this risk while preserving employee privacy?

   • ADisable all third-party app stores and allow only apps from the official app store
   • BRequire employees to install a mobile antivirus app and perform regular manual scans
   • CImplement an MDM solution that enforces a whitelist of approved apps and uses containerization to separate corporate data
   • DUse a VPN on all devices to encrypt corporate traffic
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is investigating a mobile device that is part of a botnet. The device is not rooted, but the team finds a malicious app that was installed from a third-party store. The app is using the device's camera and microphone without the user's knowledge. Which combination of factors allowed this attack to succeed?

   • AThe app exploited an OS vulnerability to gain access
   • BThe device was rooted, allowing the app to bypass permissions
   • CThe user's device was infected via a phishing email
   • DThe user granted permissions to the app, and the app was installed from an untrusted source
   Reveal Solution Discussion Select an answer first