A penetration tester is assessing a company's mobile app that handles employee expense reports. The app is distributed through the company's MDM portal and also sideloaded on some personal devices. The tester discovers that the app stores authentication tokens in plaintext in SharedPreferences on Android and in NSUserDefaults on iOS. Which mobile attack vector is most directly enabled by this finding?

SMS phishing that tricks the user into entering credentials

Local data extraction from a rooted or jailbroken device

Malicious repackaging of the app to bypass certificate checks

Man-in-the-middle interception of the app's network traffic

EC-CouncilCertified Security Specialist

Domain 4Objective 4

Mobile, IoT, and OT Attacks ECSS Practice Questions (Page 3)

Part of the Ethical Hacking Advanced Attacks and Penetration Testing domain, which makes up ~17% of our current practice bank.

51questions here

11free pages

10concepts

Questions 11–15

11foundation · easy
Which activity is part of the IoT penetration testing methodology to assess the device's network communications?
Select an answer first
12foundation · easy
In mobile penetration testing, which technique involves examining the app's code without executing it to identify vulnerabilities?
Select an answer first
13foundation · easy
Which system is typically used for wide-area monitoring and control of geographically dispersed infrastructure such as power grids and pipelines?
Select an answer first
14application · medium
A penetration tester is assessing a company's mobile app that handles employee expense reports. The app is distributed through the company's MDM portal and also sideloaded on some personal devices. The tester discovers that the app stores authentication tokens in plaintext in SharedPreferences on Android and in NSUserDefaults on iOS. Which mobile attack vector is most directly enabled by this finding?
Select an answer first
15foundation · easy
An attacker sends a highly targeted email to an OT engineer, impersonating a colleague to trick them into opening a malicious attachment. Which OT attack vector is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Mobile, IoT, and OT Attacks ECSS Practice Questions (Page 3)

Questions 11–15

Which activity is part of the IoT penetration testing methodology to assess the device's network communications?

In mobile penetration testing, which technique involves examining the app's code without executing it to identify vulnerabilities?

Which system is typically used for wide-area monitoring and control of geographically dispersed infrastructure such as power grids and pipelines?

An attacker sends a highly targeted email to an OT engineer, impersonating a colleague to trick them into opening a malicious attachment. Which OT attack vector is this?

Keep studying — Ethical Hacking Advanced Attacks and Penetration Testing