During a mobile app security assessment, a tester uses a jailbroken iOS device to inspect the app's file system and finds a plist file containing plaintext passwords. Which OWASP Mobile Top 10 risk does this demonstrate, and what is the best remediation?

Insecure Data Storage; use the iOS Keychain to store sensitive data

Insufficient Cryptography; use a stronger encryption algorithm for the plist file

Improper Platform Usage; restrict the app to run only on non-jailbroken devices

Insecure Communication; use HTTPS to transmit the passwords

A security analyst is investigating a suspicious Android app that was sideloaded onto a user's device. The analyst wants to determine whether the app has been tampered with after it was originally signed. Which check should the analyst perform?

Review the app's network traffic

Verify the app's signature using apksigner

Look at the app's icon and name

Check the app's requested permissions

A security tester is assessing a mobile app and wants to check whether it transmits sensitive data over the network in an insecure manner. Which testing technique is most appropriate?

Run a static analysis tool on the app's source code

Intercept traffic using a proxy and inspect TLS certificates

Check the app's permissions in the manifest

Review the app's privacy policy

An organization's mobile devices are being infected with ransomware that encrypts files and demands payment. The infections started after users installed apps from a third-party store. Which combination of measures would best prevent future infections?

Use a VPN for all network traffic

Restrict app installations to official stores and implement MDM to enforce this policy

Install a mobile antivirus on all devices

Disable the device's camera and microphone

A security analyst is categorizing mobile device threats for a risk assessment. Which of the following correctly pairs a mobile attack vector with its category?

A jailbroken device with modified firmware – application attack vector

An app that requests excessive permissions and exfiltrates contacts – application attack vector

A rogue Wi-Fi hotspot that intercepts traffic – device-level attack vector

A malicious QR code that directs a user to a phishing site – network attack vector

EC-CouncilCertified Ethical Hacker

Domain 7Objective 1

Mobile Attack Vectors and OWASP Mobile Top 10 CEH Practice Questions (Page 2)

Part of the Mobile, IoT and OT Hacking domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 2–4 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 6–10

6application · medium
During a mobile app security assessment, a tester uses a jailbroken iOS device to inspect the app's file system and finds a plist file containing plaintext passwords. Which OWASP Mobile Top 10 risk does this demonstrate, and what is the best remediation?
Select an answer first
7application · medium
A security analyst is investigating a suspicious Android app that was sideloaded onto a user's device. The analyst wants to determine whether the app has been tampered with after it was originally signed. Which check should the analyst perform?
Select an answer first
8application · medium
A security tester is assessing a mobile app and wants to check whether it transmits sensitive data over the network in an insecure manner. Which testing technique is most appropriate?
Select an answer first
9application · medium
An organization's mobile devices are being infected with ransomware that encrypts files and demands payment. The infections started after users installed apps from a third-party store. Which combination of measures would best prevent future infections?
Select an answer first
10foundation · easy
A security analyst is categorizing mobile device threats for a risk assessment. Which of the following correctly pairs a mobile attack vector with its category?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.