Mobile Device Threats and Security Controls NDE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company's mobile app development team is releasing a new version of its corporate expense-reporting app. The app will handle sensitive financial data. The security team wants to ensure that the app is secure before release. Which combination of measures should the team implement?

   • ARequire users to enable two-factor authentication and use a strong password
   • BConduct a security code review, perform penetration testing, and use app shielding to protect against tampering
   • CPublish the app only on the official app store and rely on the store's security review
   • DUse a VPN for all app traffic and enable remote wipe on the device
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security auditor is reviewing a mobile app that was developed in-house. The app requests access to the device's camera, microphone, and location, but the app's core functionality only requires the camera. The auditor also notes that the app stores user data in the app sandbox without encryption. Which recommendation should the auditor make?

   • AKeep the permissions but add a warning to users about data collection.
   • BRemove the microphone and location permissions and encrypt data stored in the sandbox.
   • CMove data storage to the device's external storage to avoid sandbox limitations.
   • DUse a VPN to protect data in transit and keep the permissions.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An employee downloads a mobile app from a third-party website because it is not available in the official app store. The app asks for administrative privileges. What is the most likely risk?

   • AThe app will void the device's warranty.
   • BThe app will automatically delete all personal data.
   • CThe app will cause the device to overheat.
   • DThe app may contain malware that can compromise the device.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a common method to enforce security policies on BYOD devices?

   • AUsing a Mobile Device Management (MDM) system
   • BBlocking all internet access on the device
   • CDisabling all personal apps on the device
   • DRequiring the device to be physically connected to the corporate network
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A developer is creating a mobile app that needs to access the device's camera to scan documents. The app should not have access to the user's contacts or location. Which mobile OS feature should the developer use to enforce this?

   • AImplement a VPN to prevent the app from sending location data.
   • BEncrypt the app's data so that contacts and location are not accessible.
   • CRequest camera permission at runtime and do not request other permissions.
   • DUse app sandboxing to isolate the camera from other apps.
   Reveal Solution Discussion Select an answer first