A malware analyst is performing static analysis on an Android APK. The analyst notices that the app requests the READ_SMS, RECORD_AUDIO, and SYSTEM_ALERT_WINDOW permissions. The app's code contains a class named 'UpdateService' that uses the WebView class to load a URL. Which finding is most indicative of a trojan rather than a legitimate app?

The WebView class is a standard Android component, and its presence alone does not indicate malicious behavior.

The SYSTEM_ALERT_WINDOW permission is commonly used by legitimate apps for chat heads, so it is not a concern.

The 'UpdateService' class name suggests the app is a legitimate updater, and the permissions are required for its functionality.

The combination of READ_SMS and RECORD_AUDIO permissions is excessive for an app that appears to be a simple utility, and the WebView could be used to load a phishing page.

A user installs an app from an unofficial website by manually enabling 'Unknown Sources' on their Android device. Which infection vector does this describe?

Malicious app in official store

A user reports that their Android device is infected with ransomware after clicking a link in a text message. The link led to a website that automatically downloaded and installed an APK. Which infection vector and malware type best describe this scenario?

Phishing via SMS leading to a drive-by download of ransomware.

Adware that was bundled with a legitimate app downloaded from the Play Store.

A worm that self-propagated via SMS messages to the user's contacts.

Sideloading of a trojan that was manually installed by the user.

A company has a BYOD policy that allows employees to use personal devices for work. An employee's device is infected with a trojan that has root access. The trojan is exfiltrating corporate data. The company's incident response team must remediate the device, but the employee has important personal data that is not backed up. Which remediation strategy balances security and data preservation?

Use a mobile antivirus tool to remove the trojan, then verify the device is clean before allowing it back on the network.

Isolate the device from the network, back up the personal data to a secure location, then perform a factory reset and restore the data.

Perform a factory reset of the device, which will remove the trojan but also erase all personal data.

Reinstall the operating system using a custom ROM, which will remove the trojan but may void the device's warranty.

What is the first step in remediating a mobile device infected with malware?

Installing a new operating system

Isolating the device from the network

GIAC Advanced Smartphone Forensics

Domain 4Objective 1

Mobile Device Malware Analysis GASF Practice Questions (Page 2)

Part of the Mobile Device Malware Analysis domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 8–12 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

11concepts

Questions 6–10

6application · medium
A malware analyst is performing static analysis on an Android APK. The analyst notices that the app requests the READ_SMS, RECORD_AUDIO, and SYSTEM_ALERT_WINDOW permissions. The app's code contains a class named 'UpdateService' that uses the WebView class to load a URL. Which finding is most indicative of a trojan rather than a legitimate app?
Select an answer first
7foundation · easy
A user installs an app from an unofficial website by manually enabling 'Unknown Sources' on their Android device. Which infection vector does this describe?
Select an answer first
8application · medium
A user reports that their Android device is infected with ransomware after clicking a link in a text message. The link led to a website that automatically downloaded and installed an APK. Which infection vector and malware type best describe this scenario?
Select an answer first
9expert · hard
A company has a BYOD policy that allows employees to use personal devices for work. An employee's device is infected with a trojan that has root access. The trojan is exfiltrating corporate data. The company's incident response team must remediate the device, but the employee has important personal data that is not backed up. Which remediation strategy balances security and data preservation?
Select an answer first
10foundation · easy
What is the first step in remediating a mobile device infected with malware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Mobile Device Malware Analysis GASF Practice Questions (Page 2)

Questions 6–10

A user installs an app from an unofficial website by manually enabling 'Unknown Sources' on their Android device. Which infection vector does this describe?

A user reports that their Android device is infected with ransomware after clicking a link in a text message. The link led to a website that automatically downloaded and installed an APK. Which infection vector and malware type best describe this scenario?

What is the first step in remediating a mobile device infected with malware?

Keep studying — Mobile Device Malware Analysis