An incident responder is analyzing a suspicious APK that was sideloaded onto a corporate device. The APK's package name matches a legitimate productivity app, but the app requests permissions to read SMS messages and access the device's location. The legitimate version does not request these permissions. Which conclusion is most supported by these observations?

The APK is likely repackaged, and the unexpected permissions are tampering indicators

The APK is safe because the package name matches the legitimate app

The APK is legitimate but requests permissions dynamically at runtime

The APK is a runtime-patched version that only requests permissions when the device is rooted

A mobile app development team wants to protect their app from runtime manipulation on jailbroken devices. They are considering several anti-tampering mechanisms. Which approach is most effective at detecting and responding to runtime hooking?

Implementing runtime integrity checks that verify the integrity of critical functions and detect hooking frameworks

Removing all sensitive functionality from the app to reduce attack surface

Relying solely on code obfuscation to prevent reverse engineering

Using certificate pinning to prevent the app from running on jailbroken devices

A mobile app development team wants to implement anti-tampering measures but is concerned about performance impact on low-end devices. They need to detect repackaging and runtime hooking without significantly slowing down the app. Which approach best balances security and performance?

Rely solely on code obfuscation to prevent reverse engineering

Use a hooking detection library that continuously monitors for Frida and Xposed

Perform a full integrity check of all app files at every launch

Perform a lightweight integrity check at app startup and use a server-side check for sensitive operations

A security team is evaluating an Android app for potential tampering. They have the original APK from the official store and a version that was extracted from a user's device. Which check would be the most definitive indicator of tampering?

Check if the app requests the INTERNET permission

Check the app's version code against the latest version on the store

Compare the SHA-256 hash of the extracted APK to the hash of the official APK

Compare the app's icon and name to the official version

What is the primary purpose of a hooking framework such as Frida or Xposed in the context of mobile application manipulation?

To repackage the application with a new signature

To decompile the application into readable source code

To intercept and modify function calls at runtime

To encrypt the application's data at rest

GIAC Mobile Device Security Analyst

Domain 4Objective 1

Manipulating Mobile Application Behavior GMOB Practice Questions (Page 4)

Part of the Mobile Malware and Application Behavior domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 16–20

16application · medium
An incident responder is analyzing a suspicious APK that was sideloaded onto a corporate device. The APK's package name matches a legitimate productivity app, but the app requests permissions to read SMS messages and access the device's location. The legitimate version does not request these permissions. Which conclusion is most supported by these observations?
Select an answer first
17application · medium
A mobile app development team wants to protect their app from runtime manipulation on jailbroken devices. They are considering several anti-tampering mechanisms. Which approach is most effective at detecting and responding to runtime hooking?
Select an answer first
18expert · hard
A mobile app development team wants to implement anti-tampering measures but is concerned about performance impact on low-end devices. They need to detect repackaging and runtime hooking without significantly slowing down the app. Which approach best balances security and performance?
Select an answer first
19application · medium
A security team is evaluating an Android app for potential tampering. They have the original APK from the official store and a version that was extracted from a user's device. Which check would be the most definitive indicator of tampering?
Select an answer first
20foundation · easy
What is the primary purpose of a hooking framework such as Frida or Xposed in the context of mobile application manipulation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.