A security tester wants to identify whether a mobile app is storing sensitive data insecurely on the device. Which of the following techniques would be most appropriate?

Examining the app's data directories and shared preferences on a rooted or jailbroken device

Performing a denial-of-service attack on the backend server

Intercepting network traffic with a proxy

Checking the app's code for hardcoded API keys

A company wants to implement a BYOD policy that allows employees to use their personal devices for work but requires the ability to enforce security policies such as device encryption and remote wipe. Which approach should be taken?

Install a mobile antivirus on personal devices

Require employees to use a separate company-issued device

Implement an MDM solution with a containerized work profile

Use a VPN for all corporate traffic

A company is implementing a BYOD policy and wants to ensure that if an employee's device is lost or stolen, corporate data can be remotely wiped without affecting personal data. Which MDM feature should be configured?

Selective wipe of the corporate container

In both iOS and Android, what is the primary purpose of requiring apps to be digitally signed before installation?

To encrypt the app's data at rest

To verify the identity of the app developer and ensure the app has not been tampered with

To ensure the app is free of malware

To allow the app to request permissions

EC-CouncilCertified Ethical Hacker

Domain 7Objective 1

Mobile Attack Vectors and OWASP Mobile Top 10 CEH Practice Questions (Page 3)

Part of the Mobile, IoT and OT Hacking domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 2–4 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 11–15

11foundation · easy
A security tester wants to identify whether a mobile app is storing sensitive data insecurely on the device. Which of the following techniques would be most appropriate?
Select an answer first
12application · medium
A security team is evaluating mobile OS security features to prevent malicious apps from accessing sensitive data of other apps. Which feature is most effective in isolating app data?
Select an answer first
13application · medium
A company wants to implement a BYOD policy that allows employees to use their personal devices for work but requires the ability to enforce security policies such as device encryption and remote wipe. Which approach should be taken?
Select an answer first
14application · medium
A company is implementing a BYOD policy and wants to ensure that if an employee's device is lost or stolen, corporate data can be remotely wiped without affecting personal data. Which MDM feature should be configured?
Select an answer first
15foundation · easy
In both iOS and Android, what is the primary purpose of requiring apps to be digitally signed before installation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.