Mobile Device Application Analysis GASF Practice Questions (Page 9)

Questions 41–44

1. 41foundation · easy

   What is the primary purpose of application-level encryption on a mobile device?

   • ATo reduce the app's storage footprint.
   • BTo speed up the app's performance.
   • CTo protect sensitive data stored by the app from unauthorized access.
   • DTo make the app compatible with older operating systems.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   During a forensic examination of an Android device, you need to recover a suspect's chat history from a messaging app that stores its database in the app's sandboxed internal storage. The device is rooted, and you have a full filesystem image. Which approach best preserves the integrity of the database while allowing you to analyze its contents?

   • ACopy the database file from the image to your analysis workstation and open it directly in a SQLite browser.
   • BUse a hex editor to manually parse the database file and reconstruct the chat messages without opening it in any database tool.
   • CExtract the database file, compute its SHA-256 hash, and use a forensic tool that opens a read-only copy of the database for analysis.
   • DRun the messaging app on an emulator with the extracted database to view the chats in the original interface.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   You are analyzing a suspect's device and find a social media app with a 'posts' table containing 'content', 'timestamp', and 'location' columns. You also have the suspect's GPS data from a fitness app and call detail records (CDRs) from the carrier. You need to determine if the suspect was at a specific location when a particular post was made. Which approach is most reliable?

   • ACorrelate the post's timestamp and location with the fitness app's GPS data and the CDR cell tower locations to verify the suspect's presence.
   • BUse the fitness app's GPS data to override the social media app's location, as GPS is more precise.
   • CUse only the social media app's location data, as it is directly associated with the post.
   • DUse the CDR data to override the social media app's location, as carrier data is more reliable.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   You have extracted a database from a suspect's smartphone and need to ensure the data is admissible in court. Which step is most important to verify the integrity and authenticity of the extracted data?

   • AUse a forensic tool that automatically validates the database structure and reports any errors.
   • BDocument the chain of custody for the device, but not the extracted data.
   • CCalculate and record a cryptographic hash of the extracted database file and document the hash in your report.
   • DEnsure the database file is copied to a write-protected medium before analysis.
   Reveal Solution Discussion Select an answer first