A mobile security analyst is reviewing an APK that was submitted for analysis. The analyst notices that the APK's signing certificate is self-signed and the certificate's subject does not match the app's developer. Additionally, the APK contains a native library that is not present in the original app. Which indicators of tampering are present?

Only the native library, because self-signed certificates are normal for Android apps

Only the signature mismatch, because native libraries are common in legitimate apps

Signature mismatch and unexpected native library

No indicators, because the APK is signed and contains a native library

A mobile app developer wants to implement anti-tampering measures that are difficult for an attacker to bypass. Which approach is generally considered the most robust?

Perform integrity checks on the server side and refuse to serve data if the client fails the check

Use multiple integrity checks scattered throughout the code

Use a native library to perform integrity checks

Use a third-party anti-tampering SDK

A malware analyst is examining a suspicious app that appears to be a legitimate game. The analyst notices that the app's DEX file contains a class that is not present in the original game's source code, and the app requests the INTERNET permission even though the original game is offline. Which manipulation technique is most likely responsible for these observations?

A legitimate update, because the developer added new features

Runtime patching, because the new class is loaded dynamically at runtime

Repackaging, because the DEX file has been modified and the manifest has been altered

Code injection via a debugger, because the debugger added the class

What is the purpose of an integrity check, such as verifying an app's signature or hash, as a mitigation strategy?

To hide the app's code from reverse engineering

To detect if the app has been modified or tampered with

To prevent the app from being debugged

To encrypt the app's network traffic

GIAC Mobile Device Security Analyst

Domain 4Objective 1

Manipulating Mobile Application Behavior GMOB Practice Questions (Page 1)

Part of the Mobile Malware and Application Behavior domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 1–5

1application · medium
A mobile security analyst is reviewing an APK that was submitted for analysis. The analyst notices that the APK's signing certificate is self-signed and the certificate's subject does not match the app's developer. Additionally, the APK contains a native library that is not present in the original app. Which indicators of tampering are present?
Select an answer first
2foundation · easy
Which manipulation technique is typically used to alter the behavior of an application at runtime without permanently modifying the application's stored code?
Select an answer first
3application · medium
A mobile app developer wants to implement anti-tampering measures that are difficult for an attacker to bypass. Which approach is generally considered the most robust?
Select an answer first
4application · medium
A malware analyst is examining a suspicious app that appears to be a legitimate game. The analyst notices that the app's DEX file contains a class that is not present in the original game's source code, and the app requests the INTERNET permission even though the original game is offline. Which manipulation technique is most likely responsible for these observations?
Select an answer first
5foundation · easy
What is the purpose of an integrity check, such as verifying an app's signature or hash, as a mitigation strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.

Manipulating Mobile Application Behavior GMOB Practice Questions (Page 1)

Questions 1–5

Which manipulation technique is typically used to alter the behavior of an application at runtime without permanently modifying the application's stored code?

A mobile app developer wants to implement anti-tampering measures that are difficult for an attacker to bypass. Which approach is generally considered the most robust?

What is the purpose of an integrity check, such as verifying an app's signature or hash, as a mitigation strategy?

Keep studying — Mobile Malware and Application Behavior