A security analyst is investigating a mobile device that is sending sensitive corporate data to an external server. The device is not rooted or jailbroken, and the app was installed from the official app store. Which attack vector is most likely being used?

An operating system vulnerability

A network-based man-in-the-middle attack

A malicious app that abuses permissions granted by the user

A physical attack on the device

A penetration tester is assessing a mobile app that stores sensitive data in a local database. The app is designed to run on both iOS and Android. The tester finds that the database is encrypted with a hardcoded key. Which OWASP Mobile Top 10 risk is this, and what is the best remediation?

Improper Platform Usage; use a different database library

Insecure Data Storage; remove the database and store data in the cloud

Insufficient Cryptography; use the platform's secure key storage (e.g., Keychain, Keystore) to store the encryption key

Insecure Communication; encrypt data before sending it to the server

A company is deploying a BYOD program and wants to prevent corporate email from being forwarded to personal email accounts or copied to unmanaged cloud storage. Which MDM policy should be enforced?

Require a complex device passcode

Data loss prevention (DLP) policies on the managed email app

Which of the following is an example of a device-level attack vector on a mobile device?

A phishing SMS message that tricks the user into revealing credentials

An attacker intercepting traffic on an unsecured public Wi-Fi network

An attacker exploiting a vulnerability in the mobile operating system to gain root access

A malicious app that records audio without the user's knowledge

EC-CouncilCertified Ethical Hacker

Domain 7Objective 1

Mobile Attack Vectors and OWASP Mobile Top 10 CEH Practice Questions (Page 5)

Part of the Mobile, IoT and OT Hacking domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 2–4 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 21–25

21application · medium
A security analyst is investigating a mobile device that is sending sensitive corporate data to an external server. The device is not rooted or jailbroken, and the app was installed from the official app store. Which attack vector is most likely being used?
Select an answer first
22expert · hard
A penetration tester is assessing a mobile app that stores sensitive data in a local database. The app is designed to run on both iOS and Android. The tester finds that the database is encrypted with a hardcoded key. Which OWASP Mobile Top 10 risk is this, and what is the best remediation?
Select an answer first
23application · medium
A company is deploying a BYOD program and wants to prevent corporate email from being forwarded to personal email accounts or copied to unmanaged cloud storage. Which MDM policy should be enforced?
Select an answer first
24foundation · easy
According to the OWASP Mobile Top 10, which risk is best described as the failure to use secure protocols or properly protect data during transmission?
Select an answer first
25foundation · easy
Which of the following is an example of a device-level attack vector on a mobile device?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.