Analyzing Mobile Applications GMOB Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which technique is characteristic of dynamic analysis for mobile applications?

   • AUsing a debugger to set breakpoints and inspect variables while the app runs
   • BDecompiling the app's DEX files to inspect the bytecode
   • CReviewing the AndroidManifest.xml for exported components
   • DSearching the app's strings for hardcoded API keys
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which tool is commonly used to decompile an Android APK into readable Java code?

   • AJADX
   • BNmap
   • CWireshark
   • DBurp Suite
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In Android, which file contains the manifest that defines app components and permissions?

   • Abuild.gradle
   • BAndroidManifest.xml
   • Cconfig.xml
   • DInfo.plist
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   You are analyzing an Android app that claims to securely delete sensitive data when the user logs out. The app uses a custom `SecurePreferences` class that encrypts values with a key stored in the Android Keystore. After logout, you perform a memory dump and find the plaintext values still present. Which conclusion is most accurate?

   • AThe app should use `System.gc()` after logout to ensure memory is cleared.
   • BThe app's secure deletion is incomplete because it clears the encrypted preferences but does not zeroize the plaintext data from memory.
   • CThe encryption is flawed because the key is stored in the Android Keystore, which is not secure.
   • DThe memory dump is unreliable because Android's garbage collector may have moved the data, so the finding is a false positive.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An Android app stores a user's authentication token in a file in the app's external storage directory. What is the primary security risk?

   • AThe token is stored in a location that is not backed up, so it may be lost.
   • BThe token will be lost when the app is uninstalled.
   • CThe token is stored in plaintext, which is a risk only if the device is rooted.
   • DOther apps with storage permissions can read the token because external storage is world-readable.
   Reveal Solution Discussion Select an answer first