Analyzing Mobile Applications GMOB Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a code review of an Android app, you find the following code snippet: ```java SharedPreferences prefs = getSharedPreferences("user_prefs", MODE_PRIVATE); prefs.edit().putString("auth_token", token).apply(); ``` The app also uses a WebView that loads `https://example.com` and has JavaScript enabled. Which security issue is most directly indicated by the code?

   • AThe auth token is stored in plaintext in SharedPreferences, which is not encrypted and can be read if the device is rooted or a backup is taken.
   • BThe WebView with JavaScript enabled is a critical vulnerability because it allows remote code execution.
   • CUsing `apply()` instead of `commit()` is insecure because it writes asynchronously and could lose data.
   • DThe `MODE_PRIVATE` flag is insecure because it allows other apps to read the preferences.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A mobile app development team wants to integrate a static analysis tool into their CI/CD pipeline. They are concerned about false positives and want to prioritize findings that are exploitable in the context of the app's architecture. Which approach should the security team recommend?

   • ADisable all warnings that are not related to cryptography to reduce noise.
   • BConfigure the static analysis tool to run on every commit and require developers to triage all findings, focusing on those that involve user-controlled input reaching sensitive sinks.
   • CRun the static analysis tool only on release branches to avoid slowing down development.
   • DUse the tool's default configuration and treat all findings as equally important.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You are performing dynamic analysis on an Android app that uses root detection and emulator detection. The app crashes when it detects Frida. You need to bypass these protections to continue your analysis. Which approach is most effective?

   • ARun the app in a physical device without root and use a network proxy to intercept traffic.
   • BPatch the app's smali code to remove the root detection checks and repackage the APK.
   • CUse a custom Frida server renamed to a non-default name and use Frida's `gadget` with anti-detection scripts to hide from the app's checks.
   • DUse an older version of Frida that is not detected by the app.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of dynamic analysis in a mobile application security assessment?

   • ATo inspect the app's manifest file for exported components and permissions
   • BTo execute the app and observe its behavior, interactions, and runtime state
   • CTo review the app's source code for hardcoded secrets and insecure API usage
   • DTo decompile the app's binary and reconstruct its original source code
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You are assessing an Android app that checks for root access and refuses to run if it detects root. You need to bypass this check to continue dynamic analysis. Which approach is most appropriate?

   • AModify the AndroidManifest.xml to remove the root detection permission.
   • BRecompile the app with a different package name to avoid detection.
   • CDisable SELinux to prevent the app from accessing root detection APIs.
   • DUse Frida to hook the root detection function and force it to return false.
   Reveal Solution Discussion Select an answer first