What is a rootkit on a mobile device?

A type of malware that hides its presence and provides privileged access to the device

A type of adware that displays pop-up ads

A network protocol used for command and control

A tool used to remove malware from a device

A security team is setting up a mobile malware analysis lab. They need to analyze Android and iOS malware samples. The team wants to automate the analysis process and generate reports. Which tool or framework is best suited for this task?

CuckooDroid, which is a sandbox for Android malware that can be integrated with Cuckoo Sandbox for automated analysis.

MobSF, which is an open-source mobile application security testing framework that supports both Android and iOS.

Frida, which is a dynamic instrumentation toolkit that can be used to hook functions in both Android and iOS apps.

VirusTotal, which is a public service that can scan files and provide reports.

In network traffic analysis, what does a command-and-control (C2) communication typically involve?

The malware encrypting files on the device

The malware displaying advertisements

The malware deleting system files

The malware sending data to a remote server and receiving instructions

During dynamic analysis of a suspicious Android app, the analyst observes that the app reads the device's clipboard and then sends the clipboard content to a remote server. The app also requests the READ_CLIPBOARD permission. Which behavior is the app exhibiting?

Command-and-control communication, where the app receives commands from a remote server.

Privilege escalation, where the app attempts to gain higher-level access to the device.

Persistence, where the app ensures it runs after a reboot.

Data exfiltration, where the app steals sensitive information (clipboard content) and transmits it to a remote server.

Which of the following is a key step in a mobile malware forensic investigation?

Immediately deleting suspicious files

Resetting the device to factory settings

Preserving the device's data to maintain evidence integrity

Installing antivirus software on the device

GIAC Advanced Smartphone Forensics

Domain 4Objective 1

Mobile Device Malware Analysis GASF Practice Questions (Page 7)

Part of the Mobile Device Malware Analysis domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 8–12 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

11concepts

Questions 31–35

31foundation · easy
What is a rootkit on a mobile device?
Select an answer first
32application · medium
A security team is setting up a mobile malware analysis lab. They need to analyze Android and iOS malware samples. The team wants to automate the analysis process and generate reports. Which tool or framework is best suited for this task?
Select an answer first
33foundation · easy
In network traffic analysis, what does a command-and-control (C2) communication typically involve?
Select an answer first
34application · medium
During dynamic analysis of a suspicious Android app, the analyst observes that the app reads the device's clipboard and then sends the clipboard content to a remote server. The app also requests the READ_CLIPBOARD permission. Which behavior is the app exhibiting?
Select an answer first
35foundation · easy
Which of the following is a key step in a mobile malware forensic investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.