Mobile Device Malware Analysis GASF Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A mobile device management (MDM) administrator notices that a user's Android device is sending premium SMS messages to a short code without the user's knowledge. The device also has an app that was installed from an unknown source. Which malware type is MOST likely responsible?

   • AA trojan that sends premium SMS messages to generate revenue for the attacker.
   • BA worm that self-propagates by sending SMS messages to all contacts.
   • CAdware that displays intrusive ads and generates revenue through ad clicks.
   • DRansomware that locks the device and demands payment via SMS.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which type of tool is specifically designed to execute suspicious mobile apps in an isolated environment to observe their behavior?

   • ACode editor
   • BForensic suite
   • CAntivirus engine
   • DSandbox
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's IT security team has identified that a corporate-owned Android device is infected with ransomware that has encrypted local files. The device is not connected to the corporate network. The team needs to remediate the device and prevent future infections. Which remediation strategy should be the FIRST step?

   • AAttempt to decrypt the files by contacting the ransomware operators and paying the ransom.
   • BIsolate the device by disconnecting it from all networks and disabling Wi-Fi and Bluetooth.
   • CConnect the device to the corporate network to run a full antivirus scan and remove the malware.
   • DPerform a factory reset on the device to remove the ransomware and restore it to a clean state.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of a mobile malware forensic investigation?

   • ATo remove malware from the device
   • BTo test the device's performance
   • CTo identify malware artifacts, recover evidence, and document findings
   • DTo prevent future infections
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An analyst is investigating a suspected spyware app on an Android device. The analyst has set up a proxy to intercept the app's network traffic. The app uses certificate pinning, so the proxy cannot decrypt the HTTPS traffic. The analyst observes that the app makes periodic connections to a specific IP address on port 443. Which technique would be MOST effective in determining the content of the encrypted traffic?

   • ABlock the app's network access and observe its behavior to infer what data it would have sent.
   • BAnalyze the app's decompiled code to find the encryption keys used for the network communication.
   • CUse a dynamic analysis sandbox that can bypass certificate pinning by injecting a custom CA certificate into the app's trust store.
   • DUse a network sniffer to capture the raw packets and attempt to decrypt them offline.
   Reveal Solution Discussion Select an answer first