Mobile Device Malware Analysis GASF Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   During dynamic analysis of a mobile trojan, the analyst captures network traffic and observes that the app periodically sends HTTP POST requests to a domain that resolves to a different IP address each time. The payload of the POST requests is encrypted with a base64-encoded string. Which analysis step is most likely to reveal the purpose of these communications?

   • ADecode the base64 payload and look for a decryption routine in the app's code to reveal the plaintext data.
   • BUse a network intrusion detection system (IDS) to flag the traffic as malicious and generate an alert.
   • CPerform a reverse DNS lookup on the IP addresses to identify the hosting provider and block the domain.
   • DCheck the app's manifest for the INTERNET permission to confirm that the app is allowed to make network connections.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A malware analyst is performing static analysis on an Android APK. The analyst notices that the app's AndroidManifest.xml declares a receiver for the BOOT_COMPLETED action and requests the RECEIVE_BOOT_COMPLETED permission. The app also requests the INTERNET permission. Which behavior does this combination of manifest entries MOST likely indicate?

   • AThe app is a worm that will spread to other devices.
   • BThe app is designed to start automatically after a reboot and may communicate with a remote server.
   • CThe app is a trojan that will steal SMS messages.
   • DThe app is a legitimate utility that needs to perform maintenance tasks after reboot.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In mobile malware behavior analysis, which action is characteristic of data exfiltration?

   • ADisplaying intrusive advertisements
   • BUploading contacts and call logs to a remote server
   • CEncrypting user files and demanding ransom
   • DSending SMS messages to premium-rate numbers
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is a prevention measure to reduce the risk of mobile malware infection?

   • ADisabling security updates
   • BInstalling apps only from official app stores
   • CAllowing sideloading of apps
   • DUsing the same password for all accounts
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A malware analyst is reverse engineering a heavily obfuscated Android app. The app uses string encryption and control flow flattening. The analyst has identified a critical function that validates a license key. The function is called from multiple places in the code. Which approach is most efficient for understanding the function's logic?

   • ADecompile the function with jadx and manually trace the control flow to understand the logic.
   • BSearch the app's strings for the license key format and use that to infer the validation logic.
   • CUse a deobfuscation tool like Obfuscapk to automatically reverse the obfuscation and then read the code.
   • DUse a debugger to set a breakpoint at the function entry and step through the instructions while providing a known license key.
   Reveal Solution Discussion Select an answer first