In a BYOD (Bring Your Own Device) policy, which of the following is a common security measure used to separate corporate data from personal data on the same device?

Using containerization or a work profile to isolate corporate apps and data

Installing a VPN on the device that routes all traffic through the corporate network

Encrypting the entire device with a single key

Requiring the user to disable all personal apps

A mobile threat analyst is investigating a new malware strain that spreads via SMS messages containing a link to a malicious APK. The malware then uses the device's accessibility services to grant itself additional permissions. Which combination of attack vectors does this malware use?

Network eavesdropping and man-in-the-middle attack

Social engineering via SMS and abuse of accessibility services

Physical theft and USB debugging attack

QR code phishing and NFC relay attack

An organization is implementing a BYOD policy and wants to ensure that corporate data is protected even if an employee leaves the company. The MDM solution supports selective wipe and containerization. Which approach best ensures that corporate data is removed while minimizing impact on the employee's personal data?

Revoke the employee's MDM enrollment and leave the corporate data on the device

Use selective wipe to remove the corporate container and its data

Perform a full device wipe to ensure all data is removed

Disable the employee's corporate email and cloud access

A mobile app developer wants to ensure that the app's network traffic is protected against man-in-the-middle attacks. The app currently uses HTTPS but does not validate the server certificate. Which OWASP Mobile Top 10 risk is present, and what is the recommended fix?

Improper Platform Usage; use a secure WebView

Insecure Communication; implement certificate pinning and proper certificate validation

Insufficient Cryptography; use a stronger cipher suite

Insecure Data Storage; encrypt data at rest

A security analyst is comparing the security of iOS and Android for a corporate app that handles sensitive data. The analyst notes that both platforms use sandboxing and permissions. Which difference is most relevant to mitigating malware?

Android allows sideloading of apps from unknown sources, increasing the risk of malware installation

Android uses a Linux kernel, which is inherently insecure

iOS does not allow any third-party apps

iOS apps are always more secure than Android apps

EC-CouncilCertified Ethical Hacker

Domain 7Objective 1

Mobile Attack Vectors and OWASP Mobile Top 10 CEH Practice Questions (Page 4)

Part of the Mobile, IoT and OT Hacking domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 2–4 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 16–20

16foundation · easy
In a BYOD (Bring Your Own Device) policy, which of the following is a common security measure used to separate corporate data from personal data on the same device?
Select an answer first
17expert · hard
A mobile threat analyst is investigating a new malware strain that spreads via SMS messages containing a link to a malicious APK. The malware then uses the device's accessibility services to grant itself additional permissions. Which combination of attack vectors does this malware use?
Select an answer first
18expert · hard
An organization is implementing a BYOD policy and wants to ensure that corporate data is protected even if an employee leaves the company. The MDM solution supports selective wipe and containerization. Which approach best ensures that corporate data is removed while minimizing impact on the employee's personal data?
Select an answer first
19application · medium
A mobile app developer wants to ensure that the app's network traffic is protected against man-in-the-middle attacks. The app currently uses HTTPS but does not validate the server certificate. Which OWASP Mobile Top 10 risk is present, and what is the recommended fix?
Select an answer first
20expert · hard
A security analyst is comparing the security of iOS and Android for a corporate app that handles sensitive data. The analyst notes that both platforms use sandboxing and permissions. Which difference is most relevant to mitigating malware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.