Mobile Attack Vectors and Vulnerabilities EHE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A developer is writing a mobile app that stores sensitive user data. The app must comply with a policy requiring data to be protected at rest. Which practice should the developer follow?

   • AStore data in a plain-text file in the app's external storage
   • BStore data in a database with a hard-coded encryption key
   • CUse the OS-provided encrypted storage or keychain
   • DRely on the device's full-disk encryption
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   A mobile app developer is building a health-tracking app that stores sensitive health data on the device. The app uses the platform's secure keystore to store an encryption key, but the data itself is encrypted with a weak algorithm (DES). The developer also stores a backup of the data in the app's external storage directory. Which of the following is the most critical vulnerability?

   • AUsing the secure keystore, which is not available on all devices
   • BStoring the encryption key on the device, which can be extracted by a rooted device
   • CStoring a backup in external storage, which may be accessible to other apps
   • DUsing a weak encryption algorithm (DES) for the health data
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A mobile app developer is about to release a productivity app that handles sensitive client documents. The app currently stores these documents in the app's private storage directory without any additional encryption. The developer also uses a third-party analytics SDK that sends usage data to a remote server. Which change is most important to reduce the risk of data leakage?

   • AEncrypt the documents before storing them, using a key from the platform's secure keystore.
   • BUse a longer file name to make the documents harder to find.
   • CMove the documents to external storage (SD card) to isolate them from the app sandbox.
   • DRemove the analytics SDK entirely to prevent any data from leaving the device.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is implementing a BYOD policy. Management wants to ensure that if an employee leaves the company, corporate data on their personal phone can be removed without wiping the employee's personal photos and apps. Which MDM capability should be used?

   • AContainerization or a managed profile that separates corporate apps and data from personal data.
   • BFull device wipe, which is the only way to ensure corporate data is removed.
   • CRequiring the employee to manually delete the corporate apps before leaving.
   • DRemote lock, which prevents access to the device until the employee returns it.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of app sandboxing in mobile operating systems?

   • ATo allow apps to share data freely
   • BTo speed up app performance
   • CTo enable cross-platform compatibility
   • DTo isolate apps from each other and from critical system resources
   Reveal Solution Discussion Select an answer first