A security team receives a suspicious iOS app binary from a whistleblower. The team needs to determine if the app contains any known malicious behavior without running it on a physical device. Which tool or framework is BEST suited for this task?

An antivirus engine that can scan the binary for known malware signatures.

A static analysis tool that can parse the Mach-O binary, extract strings, and check code signatures.

A network sniffer that can capture traffic from a device running the app.

A mobile device emulator that can run the iOS app in a simulated environment.

A user reports that their smartphone is sending SMS messages to premium-rate numbers without their knowledge. The user recently installed a game from a third-party app store. The game requests the SEND_SMS permission. Which malware type and infection vector are most consistent with this scenario?

Adware that displays ads and also sends SMS messages to generate revenue.

Ransomware that locks the device and sends SMS messages as a form of payment.

A worm that spread via Bluetooth and is now sending SMS messages to contacts.

A trojan delivered via a malicious app from a third-party store, which uses the SEND_SMS permission to send premium SMS messages.

Which of the following is a static analysis technique used to examine mobile app code without executing it?

Decompiling the app to read the source code

Which of the following is a characteristic of dynamic malware analysis?

Inspecting the app's manifest file

A security team is evaluating tools to analyze a suspected iOS trojan that was found on a jailbroken device. The team needs to observe the malware's network communications and system calls without altering the device's behavior. Which tool combination is most appropriate for this task?

Use an antivirus engine to scan the binary and a static analyzer to inspect the Mach-O file for suspicious strings.

Use a network proxy like mitmproxy to intercept HTTPS traffic and a syscall tracer like dtruss to monitor system calls on the jailbroken device.

Use a public sandbox like Joe Sandbox to run the iOS app and generate a report of its network traffic.

Use a mobile device management (MDM) profile to restrict the app's network access and observe the resulting errors.

GIAC Advanced Smartphone Forensics

Domain 4Objective 1

Mobile Device Malware Analysis GASF Practice Questions (Page 5)

Part of the Mobile Device Malware Analysis domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 8–12 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

11concepts

Questions 21–25

21application · medium
A security team receives a suspicious iOS app binary from a whistleblower. The team needs to determine if the app contains any known malicious behavior without running it on a physical device. Which tool or framework is BEST suited for this task?
Select an answer first
22application · medium
A user reports that their smartphone is sending SMS messages to premium-rate numbers without their knowledge. The user recently installed a game from a third-party app store. The game requests the SEND_SMS permission. Which malware type and infection vector are most consistent with this scenario?
Select an answer first
23foundation · easy
Which of the following is a static analysis technique used to examine mobile app code without executing it?
Select an answer first
24foundation · easy
Which of the following is a characteristic of dynamic malware analysis?
Select an answer first
25application · medium
A security team is evaluating tools to analyze a suspected iOS trojan that was found on a jailbroken device. The team needs to observe the malware's network communications and system calls without altering the device's behavior. Which tool combination is most appropriate for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.