Which of the following is an example of using automation in mobile app analysis?

Writing a script to scan multiple APKs for hardcoded secrets

Manually reviewing each line of code in a decompiled app

Using a proxy to manually intercept and modify each request

Reading the app's documentation to understand its features

What is the purpose of runtime manipulation in mobile application security testing?

To capture network traffic between the app and server

To alter the app's behavior at runtime to assess security controls

To decompile the app binary into readable code

To review the app's source code for vulnerabilities

During an API assessment of a mobile app, you notice that the app sends a device identifier and a one-time password (OTP) to an endpoint `/api/verify_otp`. The response includes a session token. You also observe that the OTP is generated on the client side and sent in plaintext over HTTPS. Which vulnerability is most directly indicated?

The OTP is generated client-side, which means an attacker can predict or control the OTP and bypass the verification.

The use of HTTPS is insufficient because the OTP is sent in the request body.

The device identifier is sent in plaintext, allowing an attacker to impersonate the device.

The session token is returned in the response body, which is a security risk because it can be logged by proxies.

Which of the following is a security weakness commonly found during API assessment?

The API implements rate limiting to prevent abuse

The API requires authentication for sensitive endpoints

The API uses HTTPS for all communications

The API returns more data than the client needs

GIAC Mobile Device Security Analyst

Domain 2Objective 1

Analyzing Mobile Applications GMOB Practice Questions (Page 4)

Part of the Mobile Application Analysis and Assessment domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 16–20

16foundation · easy
Which of the following is an example of using automation in mobile app analysis?
Select an answer first
17foundation · easy
What is the purpose of runtime manipulation in mobile application security testing?
Select an answer first
18foundation · easy
Which tool is commonly used to dump and analyze the memory of a mobile app?
Select an answer first
19application · medium
During an API assessment of a mobile app, you notice that the app sends a device identifier and a one-time password (OTP) to an endpoint `/api/verify_otp`. The response includes a session token. You also observe that the OTP is generated on the client side and sent in plaintext over HTTPS. Which vulnerability is most directly indicated?
Select an answer first
20foundation · easy
Which of the following is a security weakness commonly found during API assessment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.

Analyzing Mobile Applications GMOB Practice Questions (Page 4)

Questions 16–20

Which of the following is an example of using automation in mobile app analysis?

What is the purpose of runtime manipulation in mobile application security testing?

Which tool is commonly used to dump and analyze the memory of a mobile app?

Which of the following is a security weakness commonly found during API assessment?

Keep studying — Mobile Application Analysis and Assessment