Native Applications ISE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A team is building a native app for a fleet of industrial robots that operate in a facility with no internet access. The app must be deployable on both Android and iOS devices, but the team has limited resources and cannot maintain two separate codebases. They also need to ensure the app can communicate with the robots over a proprietary protocol using raw sockets. Which approach best balances the constraints?

   • ADevelop two separate native apps in parallel to ensure full functionality on both platforms.
   • BBuild a hybrid web app that runs in a WebView on both platforms and uses JavaScript to communicate with the robots.
   • CUse a cross-platform framework (e.g., Flutter or React Native) that compiles to native code and supports platform-specific socket APIs via plugins.
   • DDevelop a native app for Android only and use a web-based interface for iOS users.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A smart-home vendor's native mobile app controls Wi-Fi-enabled locks. The app stores a local cache of user credentials and device tokens to allow offline operation. A security audit reveals that the cached data is stored in plaintext in the app's sandbox. Which remediation is the most appropriate?

   • AEncrypt the cached credentials and tokens using the platform's hardware-backed keystore, and bind them to the device's secure enclave.
   • BRemove the local cache entirely and require an internet connection for every lock operation.
   • CStore the credentials in the app's shared preferences with a random filename to hide them from casual inspection.
   • DObfuscate the cached data using a custom base64 encoding scheme.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company distributes a native Android app for controlling industrial IoT devices. The app uses a self-signed certificate for TLS communication with the devices. A security review flags this as a risk. Which remediation is the most appropriate?

   • AReplace the self-signed certificate with a certificate from a trusted public CA, or implement certificate pinning with a private CA.
   • BStore the self-signed certificate in the app's assets and trust it without any validation.
   • CDisable TLS certificate validation to avoid connection errors.
   • DUse a hybrid web framework that handles TLS automatically.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company distributes a native Android app for controlling industrial sensors. The app is sideloaded by customers rather than distributed through the Play Store. The company needs to update the app to fix a critical security vulnerability. What is the most effective way to ensure customers receive the update?

   • APublish the updated APK on the company website and send an email notification to customers.
   • BImplement an in-app update check that downloads and installs the new APK automatically.
   • CDo nothing because the vulnerability is only in the app, not the sensors.
   • DUse Android's system update mechanism to push the update to all devices.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A developer is testing a native iOS app that controls a smart lock over BLE. The app intermittently fails to connect to the lock, and the developer suspects a race condition in the BLE connection handling. Which testing/debugging approach would be most effective to identify the issue?

   • ARun the app on a physical device without any debugging tools to observe the behavior in real-world conditions.
   • BSwitch to a hybrid framework that abstracts BLE to simplify the connection logic.
   • CAdd extensive logging to the app's UI to display every BLE connection attempt.
   • DUse Xcode's Instruments to profile the app's BLE activity and set breakpoints on the connection delegate callbacks.
   Reveal Solution Discussion Select an answer first