Analyzing Mobile Applications GMOB Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   You are assessing a mobile app's API. The app uses OAuth 2.0 with the authorization code flow. You notice that the app stores the client secret in the app binary. What is the best course of action to recommend?

   • ARecommend storing the client secret in the Android Keystore or iOS Keychain.
   • BRecommend using a different OAuth flow that does not require a client secret.
   • CRecommend moving to a public client type (e.g., PKCE) and removing the client secret from the app.
   • DRecommend obfuscating the client secret to make it harder to extract.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   During a dynamic analysis of an iOS app, you intercept HTTPS traffic using a proxy and install a custom CA certificate on the simulator. The app still fails to send any requests, and you see an error about certificate validation. What is the most likely cause?

   • AThe iOS simulator does not support custom CA certificates.
   • BThe app is using HTTP instead of HTTPS, so the proxy cannot intercept it.
   • CThe proxy is not configured to decrypt TLS traffic.
   • DThe app uses certificate pinning and does not trust the custom CA certificate.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   During a mobile app penetration test, you intercept HTTPS traffic using a proxy and install your CA certificate on the test device. The app uses certificate pinning, so you see only a CONNECT tunnel and no decrypted traffic. You need to analyze the API requests and responses. Which approach is most likely to succeed without modifying the app's code?

   • AAdd the proxy's CA certificate to the system trust store by remounting the system partition.
   • BSwitch to an HTTP proxy and disable TLS in the app's settings.
   • CUse Frida to hook the app's certificate validation functions and disable pinning at runtime.
   • DUse a VPN-based interception tool that captures traffic before TLS encryption.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   During a mobile app assessment, you need to test whether the app's server-side authorization checks are robust. You have intercepted the API traffic and noticed that the app sends a `userId` parameter in a POST request to fetch user profile data. You want to test for Insecure Direct Object References (IDOR). Which technique is most appropriate?

   • AUse Frida to hook the app's network library and log all outgoing requests.
   • BModify the `userId` parameter to another user's ID using a proxy tool and observe whether the response returns that user's data.
   • CRun a static analysis tool to search for hardcoded API keys in the source code.
   • DPerform a memory dump to extract the authentication token and replay it from another device.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A security team needs to assess a large number of mobile apps for common insecure practices, such as hardcoded secrets, insecure TLS configurations, and exported components. They have a limited budget and need to triage the apps quickly. Which approach is most efficient?

   • AManually reverse-engineer each app using jadx and Ghidra to ensure no issues are missed.
   • BUse a memory analysis tool on each app to look for sensitive data in memory.
   • CUse an automated static analysis tool (e.g., MobSF) to scan all apps and generate a report, then manually review the high-risk findings.
   • DRun a network proxy on a device and manually interact with each app to capture traffic.
   Reveal Solution Discussion Select an answer first