Mobile Attack Vectors and Vulnerabilities EHE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company's custom mobile app stores user credentials in a local SQLite database and requests access to the device's contacts and SMS. A security review flags these practices. Which remediation best addresses the identified risks?

   • AMove the database to the app's cache directory
   • BEncrypt the SQLite database with a hard-coded key in the app code
   • CKeep the permissions but add a warning dialog before each access
   • DRemove the contacts and SMS permissions and store credentials in the device's secure enclave or keychain
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which mobile platform vulnerability is primarily caused by the failure of an app to properly encrypt data it stores on the device?

   • AInsecure data storage
   • BOS weaknesses
   • CApp sandboxing issues
   • DJailbreaking
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   During a security review, an app is found to request permission to access the camera, microphone, and location, but the app's core functionality only requires internet access. Which risk does this pose?

   • ANo risk because permissions are only used when the app is open
   • BIncreased risk of battery drain only
   • CRisk of the app being removed from the app store
   • DIncreased risk of data leakage through excessive permissions
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A company has a BYOD policy that allows employees to use personal phones for email and calendar. The MDM solution enforces a device PIN and can remotely wipe the device. Recently, an employee's phone was lost, and the company remotely wiped it. However, the employee later complained that their personal photos were also erased. Management wants to avoid this in the future while still protecting corporate data. Which approach best balances security and employee privacy?

   • AImplement a containerized MDM profile that separates corporate apps and data, allowing selective wipe of only the corporate container.
   • BDisable remote wipe and rely on the device's built-in encryption to protect corporate data.
   • CRequire employees to use a separate corporate-owned device for work, eliminating BYOD risks.
   • DKeep the full wipe policy but require employees to back up personal data regularly.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A developer is reviewing a mobile banking app before release. The app requests access to the device's contacts, SMS, and location, although none of these are needed for its core banking functions. The developer also notices that the app stores the user's authentication token in plain text in SharedPreferences. Which two issues are most critical to address before launch?

   • AWeak encryption algorithm and outdated SDK
   • BInsecure network communication and lack of jailbreak detection
   • CLack of code obfuscation and missing certificate pinning
   • DExcessive permissions and insecure data storage
   Reveal Solution Discussion Select an answer first