An assessor is analyzing an iOS app that stores user credentials. The app uses the Keychain for the main authentication token, but the code also writes a plaintext backup of the token to the app's Documents directory. During a memory analysis, the assessor finds the token in a heap dump. Which finding is the most significant security issue?

Using the Keychain is unnecessary because the token is already protected by the app sandbox.

The presence of the token in a heap dump indicates a memory corruption vulnerability in the app.

Storing the token in the Documents directory in plaintext violates data-at-rest protection expectations and can be exposed via device backups or file system access.

The token should be stored in `NSUserDefaults` instead of the Documents directory to improve security.

A mobile app stores user credentials in SharedPreferences on Android. During a code review, you notice the app uses MODE_PRIVATE and encrypts the credentials with a hardcoded AES key. What is the most significant security issue in this implementation?

MODE_PRIVATE allows other apps on the device to read the preferences file.

SharedPreferences is inherently insecure and should never be used for any sensitive data.

The hardcoded encryption key can be extracted from the binary, allowing an attacker to decrypt the stored credentials.

The app should use SQLite instead of SharedPreferences for better security.

What is the purpose of memory analysis in mobile application security assessment?

To extract sensitive data from the app's memory and identify memory-related vulnerabilities

To capture and analyze the app's network traffic

To inspect the app's manifest for exported components

To review the app's source code for logic flaws

During a code review of a mobile app, which code pattern indicates a potential security vulnerability?

Using parameterized queries when interacting with a database

Hardcoding an encryption key inside the application source code

Using HTTPS for all network communications

Validating user input before using it in a SQL query

What is the primary purpose of network traffic analysis in mobile application assessment?

To test the app's user interface for usability issues

To decompile the app and review its source code

To analyze the app's memory for sensitive data

To identify insecure communication and data leakage between the app and its backend

GIAC Mobile Device Security Analyst

Domain 2Objective 1

Analyzing Mobile Applications GMOB Practice Questions (Page 8)

Part of the Mobile Application Analysis and Assessment domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 36–40

36application · medium
An assessor is analyzing an iOS app that stores user credentials. The app uses the Keychain for the main authentication token, but the code also writes a plaintext backup of the token to the app's Documents directory. During a memory analysis, the assessor finds the token in a heap dump. Which finding is the most significant security issue?
Select an answer first
37application · medium
A mobile app stores user credentials in SharedPreferences on Android. During a code review, you notice the app uses MODE_PRIVATE and encrypts the credentials with a hardcoded AES key. What is the most significant security issue in this implementation?
Select an answer first
38foundation · easy
What is the purpose of memory analysis in mobile application security assessment?
Select an answer first
39foundation · easy
During a code review of a mobile app, which code pattern indicates a potential security vulnerability?
Select an answer first
40foundation · easy
What is the primary purpose of network traffic analysis in mobile application assessment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.