What is the purpose of binary analysis in mobile application security assessment?

To capture and analyze the app's network traffic

To review the app's source code as written by developers

To execute the app and observe its runtime behavior

To inspect the compiled app binary to understand its structure and identify security issues

During a memory analysis of an Android app, you dump the heap and find plaintext passwords. The app uses the Android Keystore to store the passwords. What is the most likely reason the passwords are in memory?

Memory analysis is not a valid technique for finding sensitive data.

The Android Keystore stores data in plaintext by default.

The heap dump was taken before the Keystore encryption was applied.

The app decrypts the passwords from the Keystore and keeps them in memory for later use.

You are analyzing an iOS app binary and suspect that it contains a hidden debug menu that is activated by a specific URL scheme. You have extracted the binary from the IPA. Which technique is most effective for locating the URL scheme handler and understanding the condition that triggers the debug menu?

Inspect the IPA's `Info.plist` for the URL scheme and assume the debug menu is always accessible.

Use `otool` to dump the Objective-C method names and look for a method named `openDebugMenu`.

Use `strings` on the binary and search for the URL scheme, then use a disassembler like Hopper or Ghidra to trace the code path that handles the URL.

Run the app in a simulator and try different URL schemes to see which one opens the debug menu.

You are testing an iOS app that stores sensitive data in the Keychain. You need to determine if the app properly clears sensitive data from memory after use. Which technique is most appropriate?

Use LLDB to set breakpoints on the decryption function and inspect memory after the function returns.

Use `strings` on the app binary to search for the decryption key.

Use `keychain-dump` to extract the Keychain contents.

Use `otool` to examine the app's encryption routines.

You are analyzing an Android app and find that it has a content provider that is exported. The provider's `query` method uses raw SQL with user input. What is the most critical issue?

The provider is not using a ContentResolver, so it is insecure.

The provider does not require a permission, so any app can access it.

The exported provider can be queried by any app, and the SQL injection could allow data extraction or modification.

The provider's `query` method is not optimized for performance.

GIAC Mobile Device Security Analyst

Domain 2Objective 1

Analyzing Mobile Applications GMOB Practice Questions (Page 9)

Part of the Mobile Application Analysis and Assessment domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 41–45

41foundation · easy
What is the purpose of binary analysis in mobile application security assessment?
Select an answer first
42application · medium
During a memory analysis of an Android app, you dump the heap and find plaintext passwords. The app uses the Android Keystore to store the passwords. What is the most likely reason the passwords are in memory?
Select an answer first
43application · medium
You are analyzing an iOS app binary and suspect that it contains a hidden debug menu that is activated by a specific URL scheme. You have extracted the binary from the IPA. Which technique is most effective for locating the URL scheme handler and understanding the condition that triggers the debug menu?
Select an answer first
44expert · hard
You are testing an iOS app that stores sensitive data in the Keychain. You need to determine if the app properly clears sensitive data from memory after use. Which technique is most appropriate?
Select an answer first
45expert · hard
You are analyzing an Android app and find that it has a content provider that is exported. The provider's `query` method uses raw SQL with user input. What is the most critical issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.