A security analyst is triaging a suspicious iOS app binary obtained from a third-party app store. The analyst needs to determine whether the app contains known malicious code without executing it. Which tool or technique is most appropriate for this initial triage?

Run a string search and hash the binary, then compare the hash against known malware databases and inspect the code signature.

Install the app on a jailbroken iPhone in a Faraday cage and monitor its network traffic.

Submit the binary to a mobile malware sandbox that supports iOS, such as a cloud-based sandbox that can execute the app in a simulated environment and report on its behavior.

Use a debugger to step through the binary's main function to observe its initialization routine.

During a forensic investigation of a compromised Android device, the examiner finds a malicious app that has been deleted from the device. The examiner has a full filesystem image. The app's package name is known, and the examiner needs to recover evidence of the app's installation and behavior. Which forensic approach is most likely to yield the most useful artifacts?

Focus only on the app's APK file in the /data/app/ directory, which may still be present if the deletion was not complete.

Examine the device's external SD card for any files created by the app, since most Android malware stores data there.

Search the filesystem image for the app's package name in the packages.xml file, the dalvik-cache directory, and any residual files in /data/data/.

Check the device's logcat buffer for any logs generated by the app, which are always retained until the device is rebooted.

GIAC Advanced Smartphone Forensics

Domain 4Objective 1

Mobile Device Malware Analysis GASF Practice Questions (Page 11)

Part of the Mobile Device Malware Analysis domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 8–12 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

11concepts

Questions 51–53

51application · medium
A security analyst is triaging a suspicious iOS app binary obtained from a third-party app store. The analyst needs to determine whether the app contains known malicious code without executing it. Which tool or technique is most appropriate for this initial triage?
Select an answer first
52foundation · easy
Which reverse engineering technique involves converting a compiled Android app (APK) back into readable source code?
Select an answer first
53expert · hard
During a forensic investigation of a compromised Android device, the examiner finds a malicious app that has been deleted from the device. The examiner has a full filesystem image. The app's package name is known, and the examiner needs to recover evidence of the app's installation and behavior. Which forensic approach is most likely to yield the most useful artifacts?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Mobile Device Malware Analysis GASF Practice Questions (Page 11)

Questions 51–53

A security analyst is triaging a suspicious iOS app binary obtained from a third-party app store. The analyst needs to determine whether the app contains known malicious code without executing it. Which tool or technique is most appropriate for this initial triage?

Which reverse engineering technique involves converting a compiled Android app (APK) back into readable source code?

Keep studying — Mobile Device Malware Analysis