Mobile Device Malware Analysis GASF Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which network traffic pattern is commonly associated with data exfiltration by mobile malware?

   • AFrequent DNS queries to legitimate domains
   • BRegular updates from the app store
   • CLarge amounts of data being uploaded to an external server
   • DLow-volume periodic heartbeats
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A forensic examiner is investigating a suspected malware infection on an Android device. The examiner has extracted the APK and wants to determine if the app is known malware. Which tool or technique is MOST appropriate for this initial assessment?

   • ACheck the APK's permissions in the manifest to determine if it is malicious.
   • BDecompile the APK and manually review the code for malicious patterns.
   • CUse a sandbox to execute the APK and observe its behavior.
   • DSubmit the APK's hash to VirusTotal to check against multiple antivirus engines.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which type of mobile malware is specifically designed to encrypt a user's files and then demand payment to restore access?

   • ASpyware
   • BRansomware
   • CAdware
   • DTrojan
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A forensic examiner is investigating a compromised iPhone that is not jailbroken. The examiner suspects that a malicious app was installed via a sideloaded enterprise certificate. The app has been deleted, but the examiner has a full filesystem extraction. Which artifact is most likely to provide evidence of the app's installation and the enterprise certificate used?

   • AThe user's Safari history, which may show the download URL for the malicious app.
   • BThe device's sysdiagnose logs, which contain a snapshot of the system state at the time of collection.
   • CThe app's .ipa file, which may still be present in the device's cache directory.
   • DThe mobile_installation.log file, which records app installation events, including the certificate used.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   During dynamic analysis of a suspicious Android app in a sandbox, the analyst observes the device making periodic HTTPS connections to a domain that was registered 3 days ago. The domain resolves to an IP address in a country different from the app's stated developer location. The app also sends a POST request containing the device's IMEI and a list of installed apps to this domain. Which network traffic pattern is the strongest indicator of command-and-control (C2) communication?

   • AThe POST request containing the IMEI, which is a unique device identifier that no legitimate app would ever transmit.
   • BThe domain being registered only 3 days ago, which is conclusive proof of malicious activity.
   • CThe periodic, low-frequency HTTPS connections to a recently registered domain in a different country, combined with the exfiltration of device identifiers and app inventory.
   • DThe use of HTTPS encryption, which is commonly used by malware to hide C2 traffic from network inspection.
   Reveal Solution Discussion Select an answer first