Which activity is part of the static analysis process for a mobile application?

Injecting test data into the app's input fields to test for injection vulnerabilities

Running the app on an emulator and observing its UI interactions

Using a proxy to capture and analyze the app's HTTPS traffic

Decompiling the app's binary and reviewing the source code for insecure coding patterns

You are performing dynamic analysis on an Android app and need to capture the network traffic it generates. The app uses HTTPS with certificate pinning. Which approach is most effective?

Use `nmap` to scan the app's open ports.

Use `tcpdump` to capture raw packets and analyze them offline.

Use a proxy like Burp Suite and install its CA certificate on the device, then use Frida to bypass the certificate pinning.

Use `adb logcat` to view the app's network logs.

What is the focus of API and endpoint assessment in mobile application security?

Decompiling the app to understand its logic

Evaluating the security of the backend APIs that the mobile app communicates with

Analyzing the app's memory for sensitive data

Reviewing the app's user interface for usability issues

What is the purpose of data storage analysis in mobile application security assessment?

To review the app's source code for logic errors

To analyze the app's network traffic for data leakage

To examine how the app stores data locally to identify insecure storage practices

To evaluate the app's user interface for security indicators

GIAC Mobile Device Security Analyst

Domain 2Objective 1

Analyzing Mobile Applications GMOB Practice Questions (Page 5)

Part of the Mobile Application Analysis and Assessment domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 21–25

21foundation · easy
Which activity is part of the static analysis process for a mobile application?
Select an answer first
22application · medium
You are performing dynamic analysis on an Android app and need to capture the network traffic it generates. The app uses HTTPS with certificate pinning. Which approach is most effective?
Select an answer first
23foundation · easy
Which tool is commonly used to intercept and analyze mobile app network traffic?
Select an answer first
24foundation · easy
What is the focus of API and endpoint assessment in mobile application security?
Select an answer first
25foundation · easy
What is the purpose of data storage analysis in mobile application security assessment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.